Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-48909
Crítica · 9.5
Exploit público CWE-502 20/06/2026
Desserialização insegura de cookies no componente SP LMS (com_splms) para Joomla da JoomShaper
SP LMS (com_splms) < 4.1.4 da JoomShaper desserializa dados de cookies controlados pelo usuário sem validação, permitindo que um atacante remoto não autenticado execute código arbitrário no servidor.
CVE-2026-49286
Alta · 8.1
CWE-502 19/06/2026
PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.
CVE-2026-8024
Crítica · 9.8
CWE-502 18/06/2026
iba AG ibaPDA e ibaDatCoordinator: falha crítica de desserialização sem autenticação
Um atacante remoto e não autenticado pode explorar uma vulnerabilidade de desserialização de dados não confiáveis no ibaPDA ou no ibaDatCoordinator para obter acesso total aos sistemas afetados.
CVE-2026-53805
Crítica · 9.8
CWE-502 17/06/2026
NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API
NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.
CVE-2026-53874
Crítica · 9.8
CWE-502 17/06/2026
picklescan - Execução Arbitrária de Código via Chamada eval Ofuscada
picklescan anterior à versão 1.0.1 contém uma vulnerabilidade de desserialização insegura que permite a usuários não autenticados executar código arbitrário ocultando chamadas eval aninhadas em objetos chamáveis via getattr. Atacantes podem incorporar código malicioso em arquivos pickle que evita a detecção, mas é executado quando o pickle é carregado a partir de fontes não confiáveis.
CVE-2025-71321
Crítica · 9.8
CWE-502 17/06/2026
picklescan - Arbitrary File Writing via distutils Module Bypass
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.
CVE-2026-49108
Crítica · 9.8
CWE-502 17/06/2026
Tema Moderno para WordPress - Injeção de Objeto PHP anterior à 1.43
Injeção de Objeto PHP não autenticada nas versões do Moderno anteriores à 1.43.
CVE-2026-40757
Alta · 8.1
CWE-502 17/06/2026
WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.
CVE-2026-40756
Alta · 8.1
CWE-502 17/06/2026
WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.
CVE-2026-40752
Alta · 8.1
CWE-502 17/06/2026
WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.
CVE-2026-40738
Alta · 8.1
CWE-502 17/06/2026
WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.
CVE-2026-40733
Alta · 8.1
CWE-502 17/06/2026
WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.
CVE-2026-39576
Alta · 8.1
CWE-502 17/06/2026
WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.
CVE-2026-39560
Alta · 8.1
CWE-502 17/06/2026
WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.
CVE-2026-39556
Alta · 8.1
CWE-502 17/06/2026
WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.
CVE-2026-39445
Alta · 8.1
CWE-502 17/06/2026
WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
CVE-2026-39442
Alta · 8.1
CWE-502 17/06/2026
WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.
CVE-2025-69130
Alta · 8.8
CWE-502 17/06/2026
WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection.
This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.
CVE-2025-69127
Crítica · 9.8
CWE-502 17/06/2026
WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.
CVE-2025-69111
Crítica · 9.8
CWE-502 17/06/2026
WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.
CVE-2025-60236
Crítica · 9.8
CWE-502 17/06/2026
WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection.
This issue affects Creatify: from n/a through 1.5.
CVE-2025-60231
Crítica · 9.8
CWE-502 17/06/2026
WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection.
This issue affects The Hospital: from n/a through 1.8.1.
CVE-2025-60230
Crítica · 9.8
CWE-502 17/06/2026
WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection.
This issue affects The Barber Shop: from n/a through 1.9.
CVE-2025-60229
Crítica · 9.8
CWE-502 17/06/2026
WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection.
This issue affects Lagom: from n/a through 2.0.
CVE-2026-54806
Crítica · 9.8
CWE-502 17/06/2026
WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.