CVE-2026-100843

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Project-monai

Products

Monai

CVE-2026-100308

GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Gluonts

CVE-2026-97248

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96833

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96832

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96831

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96344

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-96343

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95531

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94683

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94678

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94677

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94122

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94121

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94076

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93771

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93651

WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93624

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-91051

EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-81867

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Application Integration