Threats affecting pkg:generic/osquery

CVE-2026-62008 is a critical unauthenticated PHP Object Injection vulnerability affecting Orpheus versions up to and including 1.8. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61996 is a SQL Injection vulnerability affecting MLS On The Fly versions up to and including 1.8.1.5. This flaw allows an attacker with low privileges and no user interaction to execute unauthorized SQL queries, potentially leading to high confidentiality impact and limited availability impact. The vulnerability is rated high severity with a CVSS score of 8.5.

An unauthenticated PHP Object Injection vulnerability exists in Muzicon versions up to and including 1.15. This vulnerability allows remote attackers to execute arbitrary code without authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Auction Nudge – Your eBay on Your Site versions up to 8.4.0. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

Blockonomics version 3.11.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. No affected versions beyond 3.11.0 or patch information are provided.

CVE-2026-61992 is a critical unauthenticated PHP Object Injection vulnerability affecting GEO my WordPress versions up to 4.5.5.3. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Cross Site Scripting (XSS) vulnerability exists in Podamibe Custom User Gravatar versions up to and including 1.0.8. This vulnerability affects subscribers and allows for execution of malicious scripts in the context of the affected application.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Razorpay Payment Button Elementor Plugin versions up to and including 1.2.8. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Easy Property Listings versions up to and including 3.5.25. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability affecting AjaxLoadMore Cache versions up to and including 3.1.1. This flaw allows an attacker to execute arbitrary code remotely without any authentication, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-54858 is a critical unauthenticated PHP Object Injection vulnerability affecting Printy versions up to and including 1.13.0. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.

CVE-2026-54856 is a critical unauthenticated PHP Object Injection vulnerability affecting RexCoin versions up to 1.2.6. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A PHP Object Injection vulnerability exists in YayMail versions up to and including 4.4.6. This flaw allows a shop manager with high privileges to potentially execute malicious object injection attacks. The vulnerability is identified as CVE-2026-42701 and has a high severity rating with a CVSS score of 7.2.

CVE-2026-54860 is a critical unauthenticated PHP Object Injection vulnerability affecting Ozisti versions up to and including 1.1.10. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Cross-Site Scripting (XSS) vulnerability exists in Themeum Kirki kirki up to version 6.4.0 due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker with low privileges to inject code that can be executed in the context of other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

A vulnerability in Barn2 Plugins Document Library Lite (up to version 1.3.0) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The issue is identified as CVE-2026-48200 and has a medium severity rating with a CVSS score of 5.3.

CVE-2026-54859 is a critical unauthenticated PHP Object Injection vulnerability affecting Preservation software versions up to and including 1.15. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Post Video Players versions up to and including 1.165. This vulnerability allows attackers to inject malicious scripts without authentication.

CVE-2026-54857 is a critical unauthenticated PHP Object Injection vulnerability affecting Quirky versions up to and including 1.23. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Frappe versions before 15.121.0 and 16.x before 16.34.0 have a path traversal vulnerability in their file upload handling. This flaw allows authenticated attackers to upload files outside the intended storage directory, potentially leading to remote code execution on the server. The vulnerability is critical with a CVSS score of 9.9.