CVE-2026-80428

ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

CVSS 4.0 · 9.3 Critical EPSS 4.7% KEV · Not listed

Vendors

Ilias

Products

Ilias

CVE-2026-102455

DigiWin｜EasyFlow .NET - Insecure Deserialization

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Digiwin

Products

Easyflow .net

CVE-2026-100843

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Project-monai

Products

Monai

CVE-2026-100308

GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Gluonts

CVE-2026-97248

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96833

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96832

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96831

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96344

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96343

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95531

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94683

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94678

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94677

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94122

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94121

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94076

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93771

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93651

WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93624

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—