Threats affecting pkg:generic/hdf5

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

CVE-2026-61995 is a high-severity vulnerability in emarket-design's YouTube Showcase product, affecting versions up to and including 4.1.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.

CVE-2026-61993 is a high-severity vulnerability in Blockonomics version 3.11.0 that allows unauthenticated cross-site scripting (XSS) due to improper neutralization of input during web page generation. This flaw can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-61992 is a critical vulnerability in the GEO my WordPress plugin (version 4.5.5.3 and earlier) that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

CVE-2026-61989 is a high-severity vulnerability in Easy Property Listings version 3.5.25 and earlier. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-61988 is a high-severity vulnerability affecting Auction Nudge – Your eBay on Your Site versions up to 8.4.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-54866 is a high-severity vulnerability in the Razorpay Payment Button Elementor Plugin versions up to 1.2.8. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.

CVE-2026-54865 is a cross-site scripting (XSS) vulnerability affecting Podamibe Custom User Gravatar versions up to 1.0.8. This flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-54864 is a high-severity vulnerability in nicashmu Post Video Players versions up to 1.165. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers.

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.