99 CVEs — updated 2026-11-03 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-116692 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3. | CRITICAL | 9.8 | 53%ile | NVD | 2026-10-27 |
| CVE-2026-110879 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its gene | CRITICAL | 9.8 | 68%ile | NVD | 2026-10-28 |
| CVE-2026-115968 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injecti | CRITICAL | 9.8 | 35%ile | NVD | 2026-10-28 |
| CVE-2026-54856 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | CRITICAL | 9.8 | 42%ile | NVD | 2026-10-29 |
| CVE-2026-54857 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | CRITICAL | 9.8 | 42%ile | NVD | 2026-10-29 |
| CVE-2026-54858 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | CRITICAL | 9.8 | 42%ile | NVD | 2026-10-29 |
| CVE-2026-54859 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | CRITICAL | 9.8 | 45%ile | NVD | 2026-10-29 |
| CVE-2026-54860 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | CRITICAL | 9.8 | 42%ile | NVD | 2026-10-29 |
| CVE-2026-61992 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | CRITICAL | 9.8 | 33%ile | NVD | 2026-10-29 |
| CVE-2026-61997 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | CRITICAL | 9.8 | 44%ile | NVD | 2026-10-29 |
| CVE-2026-61998 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | CRITICAL | 9.8 | 41%ile | NVD | 2026-10-29 |
| CVE-2026-62001 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | CRITICAL | 9.8 | 41%ile | NVD | 2026-10-29 |
| CVE-2026-62002 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | CRITICAL | 9.8 | 44%ile | NVD | 2026-10-29 |
| CVE-2026-62003 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62004 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62005 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62006 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | CRITICAL | 9.8 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-62008 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | CRITICAL | 9.8 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-62009 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | CRITICAL | 9.8 | 37%ile | NVD | 2026-10-29 |
| CVE-2026-62010 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62011 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62012 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | CRITICAL | 9.8 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-62013 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | CRITICAL | 9.8 | 39%ile | NVD | 2026-10-29 |
| CVE-2026-62014 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | CRITICAL | 9.8 | 37%ile | NVD | 2026-10-29 |
| CVE-2026-62015 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62016 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-62017 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | CRITICAL | 9.8 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-62018 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | CRITICAL | 9.8 | 39%ile | NVD | 2026-10-29 |
| CVE-2026-62131 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | CRITICAL | 9.8 | 24%ile | NVD | 2026-10-29 |
| CVE-2026-103039 | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 | CRITICAL | 9.8 | 43%ile | NVD | 2026-10-30 |
| CVE-2026-119526 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Roy | CRITICAL | 9.8 | 35%ile | NVD | 2026-10-30 |
| CVE-2026-39738 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Inj | CRITICAL | 9.8 | 35%ile | NVD | 2026-10-30 |
| CVE-2026-90888 | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | CRITICAL | 9.8 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-109220 | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Inject | CRITICAL | 9.8 | 44%ile | NVD | 2026-10-31 |
| CVE-2026-118636 | **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject | CRITICAL | 9.8 | 47%ile | NVD | 2026-10-31 |
| CVE-2026-102435 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient fi | CRITICAL | 9.8 | — | NVD | 2026-11-02 |
| CVE-2026-93327 | A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versio | CRITICAL | 9.4 | 34%ile | NVD | 2026-10-30 |
| CVE-2023-22793 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam | CRITICAL | 9.3 | 44%ile | NVD | 2026-10-29 |
| CVE-2026-119706 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remot | CRITICAL | 9.3 | 64%ile | NVD | 2026-10-30 |
| CVE-2026-96760 | Authlib: empty signatures validation in JWS JSON deserialization | CRITICAL | 9.1 | 38%ile | GitHub | 2026-10-27 |
| CVE-2026-103693 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an una | CRITICAL | 9.0 | 41%ile | NVD | 2026-10-29 |
| CVE-2026-75891 | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and | HIGH | 8.8 | 23%ile | NVD | 2026-10-27 |
| CVE-2026-1928 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in | HIGH | 8.8 | 45%ile | NVD | 2026-10-28 |
| CVE-2026-116391 | Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This | HIGH | 8.8 | 31%ile | NVD | 2026-10-28 |
| CVE-2026-116389 | Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Inje | HIGH | 8.8 | 21%ile | NVD | 2026-10-28 |
| CVE-2026-117612 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by th | HIGH | 8.8 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-117624 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing object | HIGH | 8.8 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-104324 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deser | HIGH | 8.8 | 52%ile | NVD | 2026-10-29 |
| CVE-2026-116866 | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | HIGH | 8.8 | 21%ile | NVD | 2026-10-29 |
| CVE-2026-116867 | Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-116868 | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | HIGH | 8.8 | 39%ile | NVD | 2026-10-29 |
| CVE-2026-118073 | Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. | HIGH | 8.8 | 33%ile | NVD | 2026-10-29 |
| CVE-2026-118075 | Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-118076 | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-118080 | Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-118081 | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-118090 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | HIGH | 8.8 | 39%ile | NVD | 2026-10-30 |
| CVE-2026-73186 | Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. | HIGH | 8.8 | 33%ile | NVD | 2026-10-30 |
| CVE-2026-78527 | Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | HIGH | 8.8 | 31%ile | NVD | 2026-10-30 |
| CVE-2026-118938 | In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val | HIGH | 8.8 | 41%ile | NVD | 2026-10-30 |
| CVE-2026-16760 | In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_ | HIGH | 8.8 | 40%ile | NVD | 2026-10-30 |
| CVE-2026-72649 | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution | HIGH | 8.8 | 60%ile | Microsoft | 2026-09-08 |
| CVE-2026-63639 | Valkey: UAF in stream deserialization may lead to remote code execution | HIGH | 8.8 | 59%ile | Microsoft | 2026-08-11 |
| CVE-2026-107238 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account | HIGH | 8.7 | 39%ile | NVD | 2026-10-29 |
| CVE-2026-63393 | OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 u | HIGH | 8.7 | 43%ile | NVD | 2026-10-30 |
| CVE-2026-120833 | labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that p | HIGH | 8.5 | — | NVD | 2026-11-03 |
| CVE-2026-104317 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitr | HIGH | 8.1 | 48%ile | NVD | 2026-10-29 |
| CVE-2026-63182 | LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate suppo | HIGH | 8.1 | 4%ile | NVD | 2026-10-30 |
| CVE-2026-118613 | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows | HIGH | 7.8 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-118617 | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerab | HIGH | 7.8 | 18%ile | NVD | 2026-10-28 |
| CVE-2026-119120 | Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bod | HIGH | 7.7 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-114422 | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored m | HIGH | 7.5 | 41%ile | NVD | 2026-10-30 |
| CVE-2026-45145 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `publ | HIGH | 7.5 | 29%ile | NVD | 2026-10-30 |
| CVE-2026-114613 | MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure | HIGH | 7.5 | 46%ile | GitHub | 2026-10-27 |
| CVE-2026-15564 | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who | HIGH | 7.4 | 2%ile | NVD | 2026-10-29 |
| CVE-2026-62848 | Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 202 | HIGH | 7.3 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-116580 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) witho | HIGH | 7.3 | 28%ile | GitHub | 2026-10-28 |
| CVE-2026-116392 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue a | HIGH | 7.2 | 23%ile | NVD | 2026-10-28 |
| CVE-2026-115590 | Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Do | HIGH | 7.2 | 23%ile | NVD | 2026-10-28 |
| CVE-2026-116390 | Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filter | HIGH | 7.2 | 23%ile | NVD | 2026-10-28 |
| CVE-2026-116864 | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-116865 | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-116869 | Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-118074 | Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-118077 | Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-118078 | Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-118079 | Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-42701 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | HIGH | 7.2 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-118089 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | HIGH | 7.2 | 33%ile | NVD | 2026-10-30 |
| CVE-2026-102554 | Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation | HIGH | 5.9 | 29%ile | GitHub | 2026-10-27 |
| CVE-2026-119284 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar | MEDIUM | 6.9 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-59396 | A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a | MEDIUM | 6.9 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-119328 | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machin | MEDIUM | 6.5 | 38%ile | NVD | 2026-10-30 |
| CVE-2026-117613 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, al | MEDIUM | 5.4 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-61803 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version | MEDIUM | 5.3 | 13%ile | NVD | 2026-10-30 |
| CVE-2026-114608 | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME | MEDIUM | — | 2%ile | GitHub | 2026-10-27 |
| CVE-2026-120320 | A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecuto | LOW | 2.0 | — | NVD | 2026-11-02 |
| CVE-2026-111551 | Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, | UNKNOWN | — | 13%ile | NVD | 2026-10-28 |
| CVE-2026-118562 | Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affect | UNKNOWN | — | 19%ile | NVD | 2026-10-30 |