Export limit exceeded: 10135 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10135 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93932 | 2 Themerex Group, Wordpress-extensions | 2 Smart Casa, Smart Casa | 2026-10-11 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12. | ||||
| CVE-2026-93931 | 2 Themerex Group, Wordpress-extensions | 2 Smash, Smash | 2026-10-11 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. | ||||
| CVE-2026-93930 | 2026-10-11 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. | ||||
| CVE-2026-93929 | 2026-10-11 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16. | ||||
| CVE-2026-93927 | 2026-10-11 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. | ||||
| CVE-2026-62130 | 2026-10-11 | 7.2 High | ||
| Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. | ||||
| CVE-2026-62046 | 2 Themerex Group, Wordpress-extensions | 2 Gutentype, Gutentype | 2026-10-11 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12. | ||||
| CVE-2026-62045 | 2 Themerex Group, Wordpress-extensions | 2 Booklovers, Booklovers | 2026-10-11 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0. | ||||
| CVE-2026-62044 | 2026-10-11 | 7.2 High | ||
| Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13. | ||||
| CVE-2026-62021 | 2026-10-11 | 8.8 High | ||
| Subscriber PHP Object Injection in Angio <= 1.1.1 versions. | ||||
| CVE-2026-42719 | 2026-10-11 | 9.8 Critical | ||
| Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. | ||||
| CVE-2026-106606 | 2026-10-11 | 7.2 High | ||
| Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0. | ||||
| CVE-2026-105885 | 2026-10-11 | 8.8 High | ||
| Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62. | ||||
| CVE-2026-105872 | 2026-10-11 | 7.2 High | ||
| Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5. | ||||
| CVE-2026-104398 | 2026-10-11 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10. | ||||
| CVE-2026-39460 | 1 Red Lion Controls | 1 700 Series | 2026-10-11 | 8.1 High |
| Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication. | ||||
| CVE-2026-108119 | 2 Busybox, Redhat | 4 Busybox, Enterprise Linux, Hardened Images and 1 more | 2026-10-11 | 6.3 Medium |
| A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution. | ||||
| CVE-2026-107857 | 1 Dongdongbh | 1 Mindwtr | 2026-10-11 | 4.4 Medium |
| Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5. | ||||
| CVE-2026-108599 | 1 Pulseaiclub | 1 Phi | 2026-10-11 | 4.7 Medium |
| phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval. | ||||
| CVE-2026-108600 | 1 Open-multi-agent | 1 Open-multi-agent | 2026-10-11 | 4.7 Medium |
| open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write. | ||||