Total
2979 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-3048 | 2026-06-17 | N/A | N/A | ||
| An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server. | |||||
| CVE-2026-3017 | 2026-06-17 | N/A | 7.2 HIGH | ||
| The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | |||||
| CVE-2026-39532 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions. | |||||
| CVE-2026-39499 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions. | |||||
| CVE-2026-39498 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in YayMail <= 4.3.3 versions. | |||||
| CVE-2026-39481 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. | |||||
| CVE-2026-39478 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions. | |||||
| CVE-2026-39474 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. | |||||
| CVE-2026-39472 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions. | |||||
| CVE-2026-39471 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. | |||||
| CVE-2026-39467 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0. | |||||
| CVE-2026-39434 | 2026-06-17 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. | |||||
| CVE-2026-39324 | 1 Rack | 1 Rack-session | 2026-06-17 | N/A | 9.8 CRITICAL |
| Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2. | |||||
| CVE-2026-39006 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. | |||||
| CVE-2026-37579 | 2026-06-17 | N/A | 7.3 HIGH | ||
| An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java component | |||||
| CVE-2026-35464 | 1 Pyload | 1 Pyload | 2026-06-17 | N/A | 7.5 HIGH |
| pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a predictable session file, and trigger arbitrary code execution when any HTTP request arrives with the corresponding session cookie. This vulnerability is fixed with commit c4cf995a2803bdbe388addfc2b0f323277efc0e1. | |||||
| CVE-2026-35439 | 1 Microsoft | 1 Sharepoint Server | 2026-06-17 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-35337 | 1 Apache | 1 Storm | 2026-06-17 | N/A | 8.8 HIGH |
| Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K. | |||||
| CVE-2026-34659 | 1 Adobe | 1 Connect Desktop Application | 2026-06-17 | N/A | 9.6 CRITICAL |
| Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | |||||
| CVE-2026-33942 | 1 Saloon | 1 Saloon | 2026-06-17 | N/A | 9.8 CRITICAL |
| Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix in version 4.0.0 removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually. | |||||