CVE-2026-65574 is a critical vulnerability in AncoraThemes Abogado versions up to and including 1.18. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). The vulnerability has a high CVSS score of 9.8, indicating it allows remote attackers to execute arbitrary code without any privileges or user interaction.
CVE-2026-65573 is a critical vulnerability in ThemeREX Abelle versions up to and including 1.22. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.
CVE-2026-65572 is a critical vulnerability in Axiomthemes A.Williams versions up to and including 1.3.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-65571 is a critical unauthenticated PHP Object Injection vulnerability affecting Axiomthemes 69 Clothing versions up to and including 1.2.11.1. This vulnerability allows remote attackers to perform deserialization of untrusted data without any authentication, potentially leading to full system compromise.
CVE-2026-65556 is a critical vulnerability in WPBruiser {no- Captcha anti-Spam} versions up to and including 3.1.43. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.
CVE-2026-65552 is a critical vulnerability in qstudio's Export User Data product, affecting versions up to and including 2.2.6. It involves PHP object injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-65549 is a high severity vulnerability in Jeg Kit for Elementor versions up to and including 3.2.10. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-28139 is a critical vulnerability in the wpdreams Ajax Search Lite plugin, affecting versions up to and including 4.14.4. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.
Apache CXF's JMS transport component is vulnerable to deserialization of untrusted data via JMS ObjectMessage bodies. This vulnerability allows an attacker who can send messages to the JMS destination to submit malicious serialized objects, potentially causing denial of service or remote code execution if a suitable gadget class is present. The issue is fixed by disabling ObjectMessage deserialization by default and providing a configuration option to re-enable it if necessary. Users should upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 to address this vulnerability.
Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase.
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.
CVE-2026-18642 is a deserialization of untrusted data vulnerability in the eta-otp-lock software developed by TUBITAK BILGEM Software Technologies Research Institute. This vulnerability allows object injection and affects versions prior to 1.0.4. The issue has been assigned a high severity rating with a CVSS score of 7.8. A fix is available in version 1.0.4.
CVE-2026-16297 is a vulnerability in the Clearfy Cache WordPress plugin before version 2.4.3. It involves unsafe deserialization of untrusted data during settings import, allowing administrator users to perform PHP Object Injection attacks. This may lead to remote code execution if a suitable gadget chain exists in the environment. The vulnerability has a medium severity rating with a CVSS score of 4.1.
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
CVE-2026-3245 is a deserialization vulnerability in Canon Production Printing's PRISMAproduction software version 6.5 and earlier. This flaw could allow an attacker to execute arbitrary code remotely. The vulnerability is rated high severity with a CVSS score of 7.7. No official patch or remediation guidance has been provided by the vendor yet. There are no known exploits in the wild at this time.
A deserialization of untrusted data vulnerability exists in the Event Booking Manager for WooCommerce WordPress plugin before version 5.3.7. This flaw allows users with Contributor-level access or higher to inject PHP objects via certain event content fields. While the plugin itself lacks a gadget chain for exploitation, if another vulnerable plugin with a gadget chain is present, this could lead to arbitrary file deletion, sensitive data exposure, or remote code execution. The issue is a partial fix of earlier object injection vulnerabilities in the same plugin. Version 5.3.7 addresses this vulnerability.
CVE-2026-12720 is a deserialization vulnerability in the Kirki WordPress plugin before version 6.0.13. It allows unauthenticated users to store serialized data without restrictions on which classes may be instantiated. When an administrator later reviews this data, it can trigger PHP Object Injection. If a suitable gadget chain exists on the site, this vulnerability could lead to remote code execution or other attacks.