Threats affecting pkg:generic/hdf5

CVE-2026-116867 is a high-severity vulnerability in sosidee's Dynamic QR Code – generator versions up to 1.0.1. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability.

CVE-2026-116866 is a high-severity vulnerability in the Extra Fees Plugin for WooCommerce by Dotstore. It involves PHP Object Injection due to deserialization of untrusted data in versions up to 4.4.0. This flaw can lead to full confidentiality, integrity, and availability compromise of affected systems.

CVE-2026-116865 is a high-severity vulnerability in Gesundheit Bewegt GmbH's Zippy product, affecting versions up to and including 1.7.0. It involves PHP object injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability.

CVE-2026-116864 is a high-severity vulnerability in Arni Cinco's WPCargo Track & Trace software versions up to 8.0.5. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability requires high privileges to exploit and does not require user interaction.

CVE-2026-108494 is a high-severity vulnerability in Bob's Chained Quiz product, affecting versions up to and including 1.4.1. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62131 is a critical vulnerability in Zoho Flow versions up to 2.14.5 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.