Critical severity threats

An unauthenticated PHP Object Injection vulnerability exists in Le Truffe versions up to and including 1.1.7. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62009 is a critical unauthenticated PHP Object Injection vulnerability affecting Filmax versions up to and including 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62011 is a critical unauthenticated PHP Object Injection vulnerability affecting Bonbon versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62008 is a critical unauthenticated PHP Object Injection vulnerability affecting Orpheus versions up to and including 1.8. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Muzicon versions up to and including 1.15. This vulnerability allows remote attackers to execute arbitrary code without authentication.

CVE-2026-61992 is a critical unauthenticated PHP Object Injection vulnerability affecting GEO my WordPress versions up to 4.5.5.3. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability affecting AjaxLoadMore Cache versions up to and including 3.1.1. This flaw allows an attacker to execute arbitrary code remotely without any authentication, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-54858 is a critical unauthenticated PHP Object Injection vulnerability affecting Printy versions up to and including 1.13.0. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.

CVE-2026-54856 is a critical unauthenticated PHP Object Injection vulnerability affecting RexCoin versions up to 1.2.6. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-54860 is a critical unauthenticated PHP Object Injection vulnerability affecting Ozisti versions up to and including 1.1.10. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-54859 is a critical unauthenticated PHP Object Injection vulnerability affecting Preservation software versions up to and including 1.15. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-54857 is a critical unauthenticated PHP Object Injection vulnerability affecting Quirky versions up to and including 1.23. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Frappe versions before 15.121.0 and 16.x before 16.34.0 have a path traversal vulnerability in their file upload handling. This flaw allows authenticated attackers to upload files outside the intended storage directory, potentially leading to remote code execution on the server. The vulnerability is critical with a CVSS score of 9.9.

A vulnerability in OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality that is not properly constrained by access control lists (ACLs). The vulnerability is rated critical with a CVSS 4.0 score of 9.9.

P-Net versions before 1.0.3, when compiled with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled, contain a vulnerability where a data length is parsed from a field in the ARVendorBlock request that is not part of the block definition. This length is used to copy bytes into a fixed-size buffer without proper bounds checking, leading to an out-of-bounds write. This flaw can cause a crash resulting in denial of service or potentially allow arbitrary code execution. The vulnerable option is disabled by default.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical vulnerability that allows a remote authenticated attacker to execute arbitrary code due to missing authorization controls. The flaw affects confidentiality, integrity, and availability with a high severity score of 9.9.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper control of code generation within the software. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of code in eval/exec functions, leading to critical security risks including full system compromise.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This flaw has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.

Bulk Share : Location Sender v2.1.0 (versionCode 5) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and control of data flow within the application.