Threats affecting pkg:generic/osquery

CVE-2026-62010 is a critical unauthenticated PHP Object Injection vulnerability affecting Avventure versions up to and including 1.1.12. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise. The vulnerability is classified under CWE-502. No patch or remediation information is currently provided.

CVE-2026-62001 is a critical unauthenticated PHP Object Injection vulnerability affecting Marcell versions up to and including 1.2.14. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated PHP Object Injection vulnerability exists in Le Truffe versions up to and including 1.1.7. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62009 is a critical unauthenticated PHP Object Injection vulnerability affecting Filmax versions up to and including 1.1.11. This vulnerability allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-62011 is a critical unauthenticated PHP Object Injection vulnerability affecting Bonbon versions up to and including 1.11. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61995 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting YouTube Showcase versions up to and including 4.1.0. This flaw allows attackers to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-62008 is a critical unauthenticated PHP Object Injection vulnerability affecting Orpheus versions up to and including 1.8. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

CVE-2026-61996 is a SQL Injection vulnerability affecting MLS On The Fly versions up to and including 1.8.1.5. This flaw allows an attacker with low privileges and no user interaction to execute unauthorized SQL queries, potentially leading to high confidentiality impact and limited availability impact. The vulnerability is rated high severity with a CVSS score of 8.5.

An unauthenticated PHP Object Injection vulnerability exists in Muzicon versions up to and including 1.15. This vulnerability allows remote attackers to execute arbitrary code without authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Auction Nudge – Your eBay on Your Site versions up to 8.4.0. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

Blockonomics version 3.11.0 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. No affected versions beyond 3.11.0 or patch information are provided.

CVE-2026-61992 is a critical unauthenticated PHP Object Injection vulnerability affecting GEO my WordPress versions up to 4.5.5.3. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Cross Site Scripting (XSS) vulnerability exists in Podamibe Custom User Gravatar versions up to and including 1.0.8. This vulnerability affects subscribers and allows for execution of malicious scripts in the context of the affected application.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Razorpay Payment Button Elementor Plugin versions up to and including 1.2.8. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Easy Property Listings versions up to and including 3.5.25. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability affecting AjaxLoadMore Cache versions up to and including 3.1.1. This flaw allows an attacker to execute arbitrary code remotely without any authentication, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-54858 is a critical unauthenticated PHP Object Injection vulnerability affecting Printy versions up to and including 1.13.0. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.

CVE-2026-54856 is a critical unauthenticated PHP Object Injection vulnerability affecting RexCoin versions up to 1.2.6. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A PHP Object Injection vulnerability exists in YayMail versions up to and including 4.4.6. This flaw allows a shop manager with high privileges to potentially execute malicious object injection attacks. The vulnerability is identified as CVE-2026-42701 and has a high severity rating with a CVSS score of 7.2.

CVE-2026-54860 is a critical unauthenticated PHP Object Injection vulnerability affecting Ozisti versions up to and including 1.1.10. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.