Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2026-109360

MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Project-monai
Products
Monai
CVE-2026-65110

Malicious Checkpoint File Remote Code Execution in NVIDIA Megatron‑LM

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Megatron-lm
CVE-2026-65180

RCE via Malicious Checkpoint in NVIDIA Megatron‑LM

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Megatron-lm
CVE-2026-106558

Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Backstage Linuxfoundation
Products
Backstage Plugin-techdocs-node Backstage and 1 more
CVE-2026-108947

yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yoshitomo-matsubara
Products
Torchdistill
CVE-2026-104723

LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-100730

Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Grid Protection Alliance
Products
Openhistorian Openpdc
CVE-2026-94676

WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94065

WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-93945

WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Axiomthemes Wordpress-extensions
Products
Balance Balance
CVE-2026-93944

WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Camelia Camelia
CVE-2026-93943

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Convex Convex
CVE-2026-93942

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Dwell Dwell
CVE-2026-93941

WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Edema Edema
CVE-2026-93940

WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Greeny Greeny
CVE-2026-93938

WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Hogwords Hogwords
CVE-2026-93937

WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Hygia Hygia
CVE-2026-93936

WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Ipharm Ipharm
CVE-2026-93935

WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Let's Play Let's Play
CVE-2026-93934

WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themerex Group Wordpress-extensions
Products
Partiso Partiso