Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,935

Export CSV
CVE-2026-62124

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62123

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62120

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62090

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62087

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62086

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62077

WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62076

WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62054

WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62053

WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62052

WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62051

WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62050

WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42723

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42718

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-42716

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78401

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-94568

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-104392

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-102554

Denial of Service via Eager Array Allocation During Deserialization in Guava

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Guava