Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,934

Export CSV
CVE-2023-22793

Unauthenticated Remote Code Execution in Veeam Management Pack for Microsoft System Center

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-107238

Authenticated Domain User Enables LocalSystem RCE in Veeam Management Pack

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Management Pack For Microsoft System Center
CVE-2026-103039

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Gravityforms Wordpress-extensions
Products
Gravity Forms Gravity Forms
CVE-2026-93327

Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Application Integration
CVE-2026-119526

WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-118090

WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62131

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62016

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62015

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62014

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62011

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62010

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62009

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62005

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62004

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62003

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61998

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61997

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61992

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—