Base de CVEs

CVE-2026-103395 Crítica · 9.8 CWE-502 30/09/2026

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.

CVE-2026-97248 Crítica · 9.8 CWE-502 30/09/2026

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

CVE-2026-97246 Média · 4.9 CWE-502 30/09/2026

WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

CVE-2026-96833 Alta · 7.2 CWE-502 30/09/2026

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

CVE-2026-96832 Alta · 7.2 CWE-502 30/09/2026

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

CVE-2026-96831 Alta · 8.8 CWE-502 30/09/2026

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

CVE-2026-96344 Alta · 7.2 CWE-502 30/09/2026

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

CVE-2026-96343 Alta · 7.2 CWE-502 30/09/2026

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

CVE-2026-95531 Alta · 8.8 CWE-502 30/09/2026

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

CVE-2026-94683 Alta · 8.8 CWE-502 30/09/2026

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

CVE-2026-94678 Alta · 8.8 CWE-502 30/09/2026

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

CVE-2026-94677 Alta · 7.2 CWE-502 30/09/2026

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVE-2026-94122 Alta · 7.2 CWE-502 30/09/2026

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

CVE-2026-94121 Alta · 8.8 CWE-502 30/09/2026

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

CVE-2026-94076 Alta · 8.8 CWE-502 30/09/2026

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

CVE-2026-93771 Alta · 7.2 CWE-502 30/09/2026

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

CVE-2026-93651 Alta · 7.2 CWE-502 30/09/2026

WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

CVE-2026-93624 Alta · 7.2 CWE-502 30/09/2026

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

CVE-2026-102455 Crítica · 9.8 CWE-502 30/09/2026

DigiWin｜EasyFlow .NET - Insecure Deserialization

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVE-2026-91051 Média · 6.6 CWE-502 30/09/2026

EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

CVE-2026-13046 Alta · 7.2 CWE-502 29/09/2026

Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

CVE-2026-103041 Crítica · 9.8 CWE-502 29/09/2026

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.

CVE-2026-103040 Crítica · 9.8 CWE-502 29/09/2026

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.

CVE-2026-101169 Alta · 8.7 CWE-502 29/09/2026

Deserialization of Untrusted Data em Octopus Deploy Octopus Server

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

CVE-2026-81867 Crítica · 9.4 CWE-502 28/09/2026

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed.