Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,435 results · page 22 of 69
Feb 20, 2026Travelicious: Deserialization of Untrusted DataCVE-2025-67997 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
- Product
- Travelicious
- What to do
- Update Travelicious to the newest version.
Feb 20, 2026Nestin: Deserialization of Untrusted DataCVE-2025-67996 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.
- Product
- Nestin
- What to do
- Update Nestin to the newest version.
Feb 20, 2026PatioTime: Deserialization of Untrusted DataCVE-2025-67995 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.
- Product
- PatioTime
- What to do
- Update PatioTime to the newest version.
Feb 19, 2026Update URLs – Quick and Easy way to search old links and replace them with new links in: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-25392 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.
- Product
- Update URLs – Quick and Easy way to search old links and replace them with new links in
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Update URLs – Quick and Easy way to search old links and replace them with new links in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026CartFlows: Deserialization of Untrusted DataCVE-2026-25316 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.
- Product
- CartFlows
- Affected
- up to 2.1.19
- What to do
- Affects up to 2.1.19. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026WpEvently: Deserialization of Untrusted DataCVE-2026-23549 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
- Product
- WpEvently
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Valenti: Deserialization of Untrusted DataCVE-2026-23544 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.
- Product
- Valenti
- Affected
- up to 5.6.3.5
- What to do
- Affects up to 5.6.3.5. Update Valenti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Grand Restaurant: Deserialization of Untrusted DataCVE-2026-23542 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
- Product
- Grand Restaurant
- Affected
- up to 7.0.10
- What to do
- Affects up to 7.0.10. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026YITH WooCommerce Compare: Deserialization of Untrusted DataCVE-2026-22333 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.
- Product
- YITH WooCommerce Compare
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update YITH WooCommerce Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection.CVE-2025-15579 · Other software · OpenText™ · reported by security@opentext.comCritical 9.5
Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code execution, denial of service, or privilege escalation. This issue affects Directory Services: before 24.4.16, from 25.1 before 25.1.9, from 25.2 before 25.2.9, from 25.3 before 25.3.8, from 25.4 before 25.4.5, from 26.1 before 26.1.2.
- Product
- Directory Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026URL Redirection to Untrusted Site ('Open Redirect') vulnerability in TR7 Cyber Defense Inc.CVE-2025-2418 · Other software · TR7 Cyber Defense Inc. · reported by iletisim@usom.gov.trMedium 4.3
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows Phishing. This issue affects Web Application Firewall: from 4.30 before v1.4.0.117.
- Product
- Web Application Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 13, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.CVE-2025-33042 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
- Product
- Apache Avro Java SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 12, 2026A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicatioCVE-2025-9293 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630High 7.7
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
- Product
- Tapo App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordomadanetworks.comtp-link.com
Feb 11, 2026CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when malicCVE-2026-1226 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file.
- Product
- EcoStruxure Building Operation Workstation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Feb 10, 2026Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.CVE-2026-21531 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
- Product
- Azure AI Language Authoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCVE-2026-21514 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
- Product
- Office
- On CISA’s list since
- Feb 10, 2026 (federal fix deadline Mar 3, 2026)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comcisa.gov
Feb 10, 2026Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.CVE-2026-21511 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-21250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-21232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 22H3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices.CVE-2025-65078 · Other software · Lexmark · reported by 7bc73191-a2b6-4c63-9918-753964601853Critical 9.3
An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.
- Product
- MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026WpEvently: Deserialization of Untrusted DataCVE-2026-24954 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.
- Product
- WpEvently
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2026Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: froCVE-2025-13984 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would alCVE-2025-40553 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
- Product
- Web Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Jan 28, 2026SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCVE-2025-40551 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedCritical 9.8
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
- Product
- Web Help Desk
- On CISA’s list since
- Feb 3, 2026 (federal fix deadline Feb 6, 2026)
- What to do
- Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocumentation.solarwinds.comsolarwinds.com
Jan 27, 2026Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extCVE-2026-24815 · Other software · datavane · reported by cve_disclosure@tech.gov.sgCritical 10
Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules). This vulnerability is associated with program files XmlFile.Java. This issue affects tis: before v4.3.0.
- Product
- tis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.CVE-2026-24656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.7
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.
- Product
- Apache Karaf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jan 22, 2026Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0773 · Other software · Upsonic · reported by zdi-disclosures@trendmicro.comCritical 9.8
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the add_tool endpoint, which listens on TCP port 7541 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26845.
- Product
- Upsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0772 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comHigh 7.5
Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27919.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCVE-2026-0770 · Other software · Langflow · reported by zdi-disclosures@trendmicro.comExploitedCritical 9.8
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
- Product
- Langflow
- On CISA’s list since
- Jul 21, 2026 (federal fix deadline Jul 24, 2026)
- What to do
- Attackers are using this now. Install Langflow’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogzerodayinitiative.comcisa.gov
Jan 22, 2026GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0764 · Other software · GPT Academic · reported by zdi-disclosures@trendmicro.comCritical 9.8
GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upload endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27957.
- Product
- GPT Academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0763 · Other software · GPT Academic · reported by zdi-disclosures@trendmicro.comCritical 9.8
GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the run_in_subprocess_wrapper_func function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27958.
- Product
- GPT Academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0762 · Other software · GPT Academic · reported by zdi-disclosures@trendmicro.comHigh 8.1
GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the stream_daas function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27956.
- Product
- GPT Academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2026-0760 · Other software · Foundation Agents · reported by zdi-disclosures@trendmicro.comCritical 9.8
Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deserialize_message function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28121.
- Product
- MetaGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15351 · Other software · Anritsu · reported by zdi-disclosures@trendmicro.comHigh 7.8
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27040.
- Product
- VectorStar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15350 · Other software · Anritsu · reported by zdi-disclosures@trendmicro.comHigh 7.8
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27039.
- Product
- VectorStar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability.CVE-2025-15348 · Other software · Anritsu · reported by zdi-disclosures@trendmicro.comHigh 7.8
Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27833.
- Product
- ShockLine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026North: Deserialization of Untrusted DataCVE-2025-69099 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.
- Product
- North
- Affected
- up to 5.7.5
- What to do
- Affects up to 5.7.5. Update North to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Sound | Musical Instruments Online Store: Deserialization of Untrusted DataCVE-2025-69079 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
- Product
- Sound | Musical Instruments Online Store
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Sound | Musical Instruments Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Tech Life CPT: Deserialization of Untrusted DataCVE-2025-69036 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through <= 16.4.
- Product
- Tech Life CPT
- Affected
- up to 16.4
- What to do
- Affects up to 16.4. Update Tech Life CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Dental Care CPT: Deserialization of Untrusted DataCVE-2025-69035 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.
- Product
- Dental Care CPT
- Fixed in
- 21.6
- What to do
- Update Dental Care CPT to 21.6 or newer.
Jan 22, 2026OneLife: Deserialization of Untrusted DataCVE-2025-69002 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
- Product
- OneLife
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update OneLife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Anona: Deserialization of Untrusted DataCVE-2025-68903 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0.
- Product
- Anona
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Anona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Vivagh: Deserialization of Untrusted DataCVE-2025-68899 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
- Product
- Vivagh
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Vivagh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Eventin: Deserialization of Untrusted DataCVE-2025-68047 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.
- Product
- Eventin
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Kids Heaven: Deserialization of Untrusted DataCVE-2025-67619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
- Product
- Kids Heaven
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Kids Heaven to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Consult Aid: Deserialization of Untrusted DataCVE-2025-67617 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
- Product
- Consult Aid
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Consult Aid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026JupiterX Core: Deserialization of Untrusted DataCVE-2025-50004 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
- Product
- JupiterX Core
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2026A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in CVE-2026-1245 · Other software · binary-parser · reported by cret@cert.orgMedium 6.5
A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code execution when untrusted values are used in parser field names or encoding parameters. The library directly interpolates these values into dynamically generated code without sanitization, enabling attackers to execute arbitrary code in the context of the Node.js process.
- Product
- binary-parser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticaCVE-2025-59959 · Network & remote access · Juniper Networks · reported by sirt@juniper.netMedium 6.8
An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS). When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected. This issue affects: Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S5-EVO, * 23.4 versions before 23.4R2-S6-EVO, * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netsupportportal.juniper.net
Jan 13, 2026The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a CVE-2025-12053 · Other software · Insyde Software · reported by 8338d8cb-57f7-4252-abc0-96fd13e98d21High 7.8
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
- Product
- InsydeH2O tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.