Threats affecting pkg:generic/hdf5

CVE-2026-118079 is a high-severity vulnerability in FolioVision's FV Flowplayer Video Player, affecting versions up to 8.3.4. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability requires high privileges to exploit and does not require user interaction.

CVE-2026-118078 is a high-severity vulnerability in the Product Catalog Feed by PixelYourSite plugin, affecting versions up to 3.1.4. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-118077 is a high-severity vulnerability in Sastra Essential Addons for Elementor by Fast Themes, affecting versions up to 1.2.3. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw can lead to complete compromise of confidentiality, integrity, and availability if exploited.

CVE-2026-118076 is a high severity vulnerability in Frisbii Pay versions up to 1.8.19 involving PHP Object Injection due to deserialization of untrusted data. This flaw allows an attacker with low privileges to execute arbitrary code or cause denial of service without user interaction.

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

CVE-2026-118074 is a high-severity vulnerability in Daman Jeet's Finale Lite software, specifically versions up to 2.21.0. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with high privileges to potentially execute arbitrary code or cause denial of service.

CVE-2026-118073 is a high-severity vulnerability in blazethemes News Kit Elementor Addons versions up to 1.5.0. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with low privileges to execute arbitrary code without user interaction, impacting confidentiality, integrity, and availability.

CVE-2026-116869 is a high-severity vulnerability in myPOS Checkout versions up to 1.4.5. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with high privileges to execute arbitrary code or cause denial of service by manipulating serialized PHP objects.

CVE-2026-116868 is a high-severity vulnerability in BuddyDev's BuddyPress Xprofile Custom Field Types plugin versions up to 1.3.1. It involves PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

CVE-2026-116866 is a high-severity vulnerability in the Extra Fees Plugin for WooCommerce by Dotstore. It involves PHP Object Injection due to deserialization of untrusted data in versions up to 4.4.0. This flaw can lead to full confidentiality, integrity, and availability compromise of affected systems.

CVE-2026-116865 is a high-severity vulnerability in Gesundheit Bewegt GmbH's Zippy product, affecting versions up to and including 1.7.0. It involves PHP object injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability.

CVE-2026-116864 is a high-severity vulnerability in Arni Cinco's WPCargo Track & Trace software versions up to 8.0.5. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability requires high privileges to exploit and does not require user interaction.

CVE-2026-108494 is a high-severity vulnerability in Bob's Chained Quiz product, affecting versions up to and including 1.4.1. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62131 is a critical vulnerability in Zoho Flow versions up to 2.14.5 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-62018 is a critical vulnerability in ThemeREX Gunslinger versions up to 1.11, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVE-2026-62016 is a critical vulnerability in ThemeREX Gamic versions up to 1.19 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction.

CVE-2026-62015 is a critical vulnerability in ThemeREX Gamezone versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.