CVE-2026-62077

WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62076

WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62054

WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62053

WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62052

WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62051

WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-62050

WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42723

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42718

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42716

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-20321

Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of user-controlled command arguments. An attacker could exploit this vulnerability by authenticating using the API and sending crafted input. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device with root-level privileges.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Application Policy Infrastructure Controller (apic)

CVE-2026-76465

Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with&nbsp;root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with&nbsp;root privileges and could cause process crashes, which could result in a device reload and a DoS condition.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Nx-os Software

CVE-2026-82049

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Python

Products

Cpython

CVE-2026-78401

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Security Verify Access Security Verify Access Container Verify Identity Access and 1 more

CVE-2026-107282

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Asynchttpclient Project

Products

Async-http-client

CVE-2026-107231

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, Realm.Builder treats a Digest challenge that yields no usable nonce as a Basic challenge. A malicious origin or proxy can label a challenge Digest while omitting or emptying the nonce, causing the client to resend the username and password using reversible Basic authentication. Both origin and proxy challenge parsers are affected. This issue is fixed in versions 3.0.13 and 2.16.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Asynchttpclient Project

Products

Async-http-client

CVE-2026-94568

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104392

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107783

Insertion of sensitive information into log file in AWS Tools for PowerShell

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws-tools-for-powershell

CVE-2026-102554

Denial of Service via Eager Array Allocation During Deserialization in Guava

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Guava