CVE-2026-39738 is a critical deserialization of untrusted data vulnerability in Aman FunnelKit Automations (wp-marketing-automations) that allows object injection. It affects versions from initial releases up to 3.8.6.1. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. A fixed version 3.8.6.2 is available.
CVE-2026-61803 is a business-logic vulnerability in Frappe Learning Management System (LMS) versions prior to 2.52.1. It allows an authenticated user to manipulate the pricing in the course or certificate checkout flow, enabling purchase completion at incorrect prices. The flaw does not expose other users' data or grant elevated privileges. The issue is fixed in version 2.52.1.
CVE-2026-93327 is a critical deserialization of untrusted data vulnerability in the SubWorkflow task of Google Cloud Application Integration prior to the 2026-09-11 patch. It allows an authenticated attacker to execute arbitrary code by submitting a malicious serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required as Google manages remediation for this cloud service.
Chamilo LMS versions prior to 2.0.1 contain a deserialization vulnerability in the handling of the user_career.extra_data field. The application uses PHP's unserialize() function without restricting allowed classes, enabling attackers who can write crafted serialized objects to execute arbitrary OS commands via gadget chains in Symfony, Doctrine, or Monolog components. This vulnerability allows compromise of server confidentiality, integrity, and availability. The issue is fixed in version 2.0.1.
Gravity Forms plugin for WordPress versions up to 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of type List. This occurs because the plugin uses WordPress' global maybe_unserialize() without restrictions instead of its own hardened deserialization function. An attacker can inject PHP objects into post meta, potentially leading to remote code execution if a suitable gadget chain exists in other plugins, themes, or WordPress core. The vulnerability is critical with a CVSS score of 9.8.
CVE-2026-114422 is a high-severity vulnerability in the Enable Media Replace WordPress plugin versions 4.1.4 up to but not including 4.2.3. It involves unsafe deserialization of untrusted data during the media replace-and-update-links process, allowing unauthenticated users to inject PHP objects. This can lead to PHP Object Injection and local file inclusion, potentially escalating to remote code execution if attacker-controlled PHP or HTML files exist on the server. The issue is a regression of a previously fixed vulnerability (CVE-2023-4643) that was reintroduced in version 4.1.4 and fixed again in 4.2.3.
CVE-2026-118562 is a deserialization of untrusted data vulnerability in the Drupal Single Content Sync module. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects versions from 0.0.0 up to but not including 1.4.19. A fix is available in version 1.4.19. The vulnerability has a high severity with a CVSS score of 7.2.
CVE-2026-107238 is a high-severity vulnerability in Veeam Management Pack for Microsoft System Center versions 9.0 up to but not including 13.1.0.334. It allows an authenticated domain user to execute remote code with LocalSystem privileges on servers running the Collector service. The flaw is due to deserialization of untrusted data (CWE-502). A fix is available in version 13.1.0.334.
CVE-2026-118081 is a high-severity vulnerability in 10Web Social Photo Feed versions up to 1.5.6. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with low privileges to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-118080 is a high-severity vulnerability in Social Snap versions up to 1.5.4 involving PHP Object Injection due to deserialization of untrusted data. This flaw allows an attacker with low privileges to execute arbitrary code, resulting in full confidentiality, integrity, and availability compromise.
CVE-2026-118079 is a deserialization of untrusted data vulnerability in the FolioVision FV Flowplayer Video Player plugin for WordPress. It allows object injection, which can lead to complete compromise of confidentiality, integrity, and availability. The issue affects all versions from initial releases up to 7.5.56.7212 and is fixed in version 7.5.57.7212.
CVE-2026-118078 is a high-severity vulnerability in Product Catalog Feed by PixelYourSite versions up to 3.1.4. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability.
CVE-2026-118077 is a high-severity vulnerability in Sastra Essential Addons for Elementor versions up to 1.2.3. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with high privileges to execute arbitrary code, impacting confidentiality, integrity, and availability.
CVE-2026-118076 is a high-severity vulnerability in Frisbii Pay versions up to 1.8.19 involving PHP Object Injection due to deserialization of untrusted data. This flaw allows an attacker with low privileges to execute arbitrary code, causing full confidentiality, integrity, and availability impact.
CVE-2026-118075 is a high-severity vulnerability in WP Media folders version 1.1.10 and earlier. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full confidentiality, integrity, and availability compromise. The vulnerability requires low attack complexity and no user interaction but does require some privileges.
CVE-2026-118074 is a high-severity vulnerability in Daman Jeet's Finale Lite product, specifically affecting versions up to 2.21.0. It involves PHP Object Injection due to deserialization of untrusted data, categorized under CWE-502. This flaw allows an attacker with high privileges to potentially execute arbitrary code or cause denial of service.
CVE-2026-118073 is a high-severity vulnerability in blazethemes News Kit Elementor Addons version 1.5.0 and earlier. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-116869 is a high-severity vulnerability in myPOS Checkout versions up to 1.4.5 involving PHP Object Injection due to deserialization of untrusted data. This flaw allows a shop manager to potentially execute malicious code via crafted input. The vulnerability is identified as CWE-502 and has a CVSS 3.1 base score of 7.2, indicating significant impact on confidentiality, integrity, and availability.