A high-severity vulnerability (CVE-2026-39532) exists in Events Calendar for GeoDirectory versions up to 2.3.25. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw can lead to complete compromise of confidentiality, integrity, and availability of affected systems. No official patch or remediation guidance is currently provided by the vendor.
A high-severity vulnerability (CVE-2026-39499) exists in Wombat Plugins' Advanced Product Fields (Product Addons) for WooCommerce versions up to 1.6.19. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full confidentiality, integrity, and availability compromise. The vulnerability requires high privileges and no user interaction but can be exploited remotely over the network.
A high-severity vulnerability (CVE-2026-39498) exists in Yeeaddons YayMail versions up to and including 4.3.3. It involves PHP Object Injection due to deserialization of untrusted data, allowing a shop manager level user to potentially execute malicious actions. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-39481 is a high-severity vulnerability in WP Chill's Modula Image Gallery plugin, affecting versions up to and including 2.14.18. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw can lead to complete compromise of confidentiality, integrity, and availability without user interaction and requires high privileges to exploit.
CVE-2026-39474 is a high-severity vulnerability in metaphorcreations Post Duplicator plugin versions up to and including 3.0.10. It involves PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker with low privileges to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently provided by the vendor.
A high-severity vulnerability (CVE-2026-39472) exists in WP Overnight's WooCommerce PDF Invoices & Packing Slips plugin before version 5.9.0. It involves PHP Object Injection due to deserialization of untrusted data by users with shop manager privileges. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently provided.
A high-severity vulnerability (CVE-2026-39434) exists in WebAppick CTX Feed versions up to and including 6.6.26. It involves PHP Object Injection due to deserialization of untrusted data, categorized under CWE-502. This flaw can lead to complete compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-27333 is a high-severity vulnerability in VideoWhisper.com's Paid Videochat Turnkey Site affecting versions up to and including 7.3.23. It involves unauthenticated deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-27053 is a critical vulnerability in VideoWhisper.com Broadcast Live Video versions prior to 7.1.3. It involves unauthenticated PHP object injection, classified under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows remote attackers to execute arbitrary code without authentication. The CVSS score is 9.8, indicating a high severity with full impact on confidentiality, integrity, and availability.
CVE-2026-9691 is a critical vulnerability involving unauthenticated PHP object injection in the CRM Perks Integration plugin for ActiveCampaign and Contact Form 7, WPForms, Elementor, and Ninja Forms. It affects all plugin versions up to and including 1.1.1. This vulnerability allows remote attackers to perform deserialization of untrusted data, potentially leading to full system compromise without requiring authentication.
Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization is performed without proper validation or class restrictions, crafted payloads can trigger dangerous magic methods (e.g., __wakeup() and __destruct()) and leverage gadget chains, resulting in arbitrary code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.
When successfully exploited, this vulnerability allows attackers to execute arbitrary code on the server via manipulated serialized data transmitted over an unprotected channel.
This issue was mitigated by limiting the communication to HTTPS in a patch for version 6.8 published on 14.05.2026, deployments without this patch remain vulnerable.
CVE-2026-50632 is a high-severity vulnerability in Apache CXF related to improper input validation and deserialization of untrusted JMS configuration data. It stems from an incomplete fix of a previous issue (CVE-2026-44417) and allows untrusted users who can configure JMS to achieve arbitrary code execution, potentially leading to full system compromise. The vulnerability affects multiple Apache CXF versions prior to fixed releases 4.2.2, 4.1.7, and 3.6.12. Mitigation involves restricting JMS configuration access to trusted administrators only. Official patches are available in the specified fixed versions.
CVE-2026-50633 is a high-severity JNDI Injection vulnerability in Apache CXF's JCA integration module that allows arbitrary code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters. The vulnerability affects multiple versions of Apache CXF prior to 4.1.7, 4.2.2, and 3.6.12. The attack complexity is high, requiring specific conditions for exploitation. Red Hat products shipping Apache CXF are affected, but no effective mitigation is currently available that meets Red Hat's criteria. Users are recommended to upgrade to fixed versions to remediate the issue.
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards.
This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.
An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.
Affected versions:
Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions:
Spring Security 7.0.0 through 7.0.5.