CVE-2025-62368

Taiga Authenticated Remote Code Execution

Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.

CVSS 3.1 · 9.1 Critical EPSS 1.5% KEV · Not listed

Vendors

Taiga

Products

Taiga

CVE-2025-64227

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Boldgrid Wordpress

Products

Client Invoicing By Sprout Invoices Wordpress

CVE-2025-64233

WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-66055

WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Icegram Wordpress

Products

Email Subscribers & Newsletters Wordpress

CVE-2025-67617

WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-67619

WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Kids Heaven Wordpress

CVE-2025-67911

WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Tribulant Wordpress

Products

Newsletters Wordpress

CVE-2025-68526

WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n/a through <= 1.6.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

A Wp Life Wordpress

Products

Modal Popup Box Wordpress

CVE-2025-68531

WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injection.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Modeltheme Wordpress

Products

Addons For Wpbakery And Elementor Wordpress

CVE-2025-68899

WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Vivagh Wordpress

CVE-2025-68903

WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-69079

WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-69099

WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-2180

Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Checkov

CVE-2025-15579

An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection.  The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Opentext

Products

Directory Services

CVE-2025-1077

Remote Code Execution vulnerability in IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather)

A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled. A remote unauthenticated attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices. Upgrade to the patched versions 7.3.10 (or higher), 8.6.0 (or higher).

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-69294

WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from n/a through <= 1.5.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Peakshops Wordpress

CVE-2025-69301

WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Photome Wordpress

CVE-2025-69328

WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Magepeople Wordpress

Products

Booking & Rental Manager Wordpress

CVE-2025-69329

WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Jthemes Wordpress

Products

Prestige Wordpress