CWE-502: Deserialization of Untrusted Data vulnerabilities

CVE-2026-116868 is a high-severity vulnerability in BuddyDev's BuddyPress Xprofile Custom Field Types plugin versions up to 1.3.1. It involves PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-116867 is a high-severity vulnerability in sosidee Dynamic QR Code – generator versions up to 1.0.1. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-116866 is a high-severity vulnerability in the Extra Fees Plugin for WooCommerce by Dotstore, affecting versions up to 4.4.0. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-116865 is a high-severity vulnerability in Gesundheit Bewegt GmbH's Zippy product, affecting versions up to and including 1.7.0. It involves PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

CVE-2026-116864 is a high-severity vulnerability in Arni Cinco's WPCargo Track & Trace software versions up to and including 8.0.5. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw can lead to complete confidentiality, integrity, and availability compromise of the affected system.

CVE-2026-62131 is a critical vulnerability in Zoho Flow versions up to 2.14.5 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVE-2026-62016 is a critical vulnerability in ThemeREX Gamic versions up to 1.19 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62015 is a critical vulnerability in ThemeREX Gamezone versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise, including complete confidentiality, integrity, and availability loss.

CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVE-2026-62012 is a critical vulnerability in ThemeREX Coinpress versions up to 1.0.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62011 is a critical vulnerability in ThemeREX Bonbon versions up to 1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62010 is a critical vulnerability in ThemeREX Avventure versions up to 1.1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-62009 is a critical vulnerability in ThemeREX Filmax versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVE-2026-62006 is a critical vulnerability in ThemeREX Nuts versions up to 1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62005 is a critical vulnerability in ThemeREX Muzicon versions up to 1.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-62004 is a critical vulnerability in ThemeREX Motorix versions 1.11 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing remote attackers to execute arbitrary code without any privileges or user interaction.