Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,935

Export CSV
CVE-2025-69130

WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Themovation Wordpress
Products
Entrepreneur - Booking For Small Businesses Wordpress Theme Wordpress
CVE-2026-84646

jenkins: Jenkins: Unauthorized creation of user objects via deserialization vulnerability

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Jenkins Jenkins
CVE-2026-80946

fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req->in.h out to the ring in fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit(). Both headers live inside the fuse_request slab object, whose cache (fuse_req_cachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and panics: usercopy: Kernel memory exposure attempt detected from SLUB object 'fuse_request' (offset 56, size 40)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort (mm/usercopy.c:90) Call Trace: __check_heap_object (mm/slub.c:8268) __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223) copy_header_to_ring (fs/fuse/dev_uring.c:618) fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785) fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306) tctx_task_work_run (io_uring/tw.c:96) task_work_run (kernel/task_work.c:233) io_run_task_work (io_uring/tw.h:84) io_cqring_wait (io_uring/wait.c:278) __do_sys_io_uring_enter (io_uring/io_uring.c:2685) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Bounce both headers through an on-stack copy so the usercopy touches stack memory, not the slab object.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-7888

Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction.

Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. The Form block and File/Set sinks were addressed in 9.5.2; the Workflow component sinks were addressed in 9.5.3. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 and Sanjorn Keeratirungsan (dizconnect) for independently reporting the original components, and sh4d0byss for reporting the Workflow component wasn't fixed in 9.5.2. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 8.4 with vector CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/ VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-77092

Content Extractor Privilege Escalation

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Commvault
Products
Commvault
CVE-2026-66256

Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Shindig
CVE-2026-11363

Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Kstover Wordpress
Products
Ninja Forms – The Contact Form Builder That Grows With You Wordpress
CVE-2026-87822

t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tdunning
Products
T-digest
CVE-2026-87874

Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ceph Storage Openstack Openstack Platform
CVE-2026-87930

MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Max-3000 Maxsite
Products
Maxsite Cms Maxsite Cms
CVE-2026-47878

Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Batch Spring Batch
CVE-2026-47880

DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-82925

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-73532

Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmanageninja
Products
Wordpress Fluent Forms
CVE-2026-65772

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Microsoft
Products
Dynamics 365