Export limit exceeded: 418956 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3687 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104734 | 2 Themeum, Wordpress-extensions | 2 Kirki, Kirki | 2026-10-18 | 7.2 High |
| The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone. | ||||
| CVE-2026-96186 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 7.8 High |
| Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-65674 | 1 Microsoft | 9 Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2019 For X64-based Systems \(cu32\), Microsoft Sql Server 2022 (gdr) and 6 more | 2026-10-17 | 8.8 High |
| Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-83520 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-16 | 8.8 High |
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-70035 | 1 Microsoft | 4 .net, .net Framework, Microsoft Visual Studio 2026 Version 18.10 and 1 more | 2026-10-16 | 8.8 High |
| Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-87697 | 1 Microsoft | 3 .net, Microsoft Visual Studio 2026 Version 18.10, Visual Studio 2022 | 2026-10-16 | 8.8 High |
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-111094 | 1 Jetbrains | 1 Teamcity | 2026-10-16 | 8.1 High |
| In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | ||||
| CVE-2026-110812 | 1 Aws | 1 Amazon Neptune Engine | 2026-10-16 | 9.9 Critical |
| Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1) | ||||
| CVE-2026-75941 | 1 Lenovo | 1 Legion Zone Application | 2026-10-16 | 8 High |
| A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code. | ||||
| CVE-2026-97296 | 2026-10-16 | 8.1 High | ||
| Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1. | ||||
| CVE-2026-104932 | 2026-10-16 | 8 High | ||
| The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code. | ||||
| CVE-2026-88131 | 1 Microsoft | 1 Dataverse | 2026-10-15 | 9.8 Critical |
| Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2018-7489 | 4 Debian, Fasterxml, Oracle and 1 more | 10 Debian Linux, Jackson-databind, Communications Billing And Revenue Management and 7 more | 2026-10-15 | N/A |
| FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath. | ||||
| CVE-2018-19362 | 4 Debian, Fasterxml, Oracle and 1 more | 22 Debian Linux, Jackson-databind, Business Process Management Suite and 19 more | 2026-10-15 | N/A |
| FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. | ||||
| CVE-2018-19361 | 4 Debian, Fasterxml, Oracle and 1 more | 22 Debian Linux, Jackson-databind, Business Process Management Suite and 19 more | 2026-10-15 | N/A |
| FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization. | ||||
| CVE-2018-19360 | 4 Debian, Fasterxml, Oracle and 1 more | 22 Debian Linux, Jackson-databind, Business Process Management Suite and 19 more | 2026-10-15 | N/A |
| FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization. | ||||
| CVE-2018-14720 | 4 Debian, Fasterxml, Oracle and 1 more | 21 Debian Linux, Jackson-databind, Banking Platform and 18 more | 2026-10-15 | N/A |
| FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization. | ||||
| CVE-2018-12023 | 5 Debian, Fasterxml, Fedoraproject and 2 more | 20 Debian Linux, Jackson-databind, Fedora and 17 more | 2026-10-15 | N/A |
| An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload. | ||||
| CVE-2026-108291 | 2026-10-15 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1. | ||||
| CVE-2026-104764 | 2026-10-15 | 7.2 High | ||
| The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | ||||