Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2026-116866

WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-116865

WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-116864

WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61803

Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Lms
CVE-2026-104324

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-104317

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm Langflow
Products
Langflow Oss Langflow
CVE-2026-59396

DoS Vulnerability in UAA Related to JWKS URI Handling

A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudfoundry
Products
Cf-deployment Uaa
CVE-2026-45145

Chamilo LMS: Database-backed PHP object injection in career deserialization

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Chamilo
Products
Chamilo Lms
CVE-2026-119706

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed
Vendors
Internlm
Products
Lmdeploy
CVE-2026-114422

Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a routine media replacement, resulting in PHP Object Injection and local file inclusion of existing PHP/HTML files, which can be escalated to remote code execution where an attacker-influenced PHP or HTML file is present on the server. This is a regression of CVE-2023-4643, which was fixed in 4.1.3 and reintroduced in 4.1.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Enable Media Replace
CVE-2026-62018

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62013

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62008

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62002

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-54859

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-118081

WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-116868

WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62017

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-62012

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—