113680 matches found
CVE-2026-39443: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EmallShop = 2.4.21 versions...
CVE-2025-69162: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Grecko = 5.17 versions...
WordPress Theme: homeroofer: CVE-2025-58954: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...
WordPress Theme: joly: CVE-2025-58953: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Unauthenticated Local File Inclusion in Joly = 1.22.0 versions...
CVE-2026-54814: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
CVE-2026-12256: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3...
CVE-2026-40753: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...
CVE-2026-39577: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...
CVE-2026-11407: Improper Neutralization of Special Elements Used in a Template Engine
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...
CVE-2026-39578: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Valiance = 1.2 versions...
CVE-2026-52706: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
CVE-2026-39446: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...
CVE-2026-40755: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
GHSA-F59H-Q822-G45G Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Summary forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with . This lets a client send an underscor...
CVE-2026-40761
WordPress Theme Valeska <= 1.2.2 is affected by an unauthenticated PHP Object Injection vulnerability. Affected component: Valeska theme (WordPress). Root cause: PHP object injection in versions
CVE-2026-40761 WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...
CVE-2026-40760 WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Behold = 1.5 versions...
CVE-2026-40759
CVE-2026-40759 affects WordPress Esmée theme versions