5683 matches found
CVE-2026-40753: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...
CVE-2026-40751: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Ashtanga = 1.2 versions...
CVE-2026-39545: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Zermatt = 1.6.1 versions...
CVE-2026-39539: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...
CVE-2026-39529: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2026-52706: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
CVE-2026-42380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
CVE-2026-54806: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...
CVE-2026-39556: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
CVE-2026-40733: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-39576: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...
CVE-2026-39442: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...
CVE-2026-40757: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Château = 1.2.1 versions...
CVE-2026-39445: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-40756: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Zoya = 1.4 versions...
CVE-2026-39580: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...
CVE-2026-12256: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3...
Drupal core - Critical - PHP object injection - SA-CORE-2026-005
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...