Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,809 results · page 25 of 37

Mar 28, 2024MainWP Links Manager Extension: Deserialization of Untrusted DataCVE-2023-23649 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1.
Product
MainWP Links Manager Extension
Affected
up to 2.1
What to do
Affects up to 2.1. Update MainWP Links Manager Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Sunshine Photo Cart: Deserialization of Untrusted DataCVE-2024-30221 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.1.1.
Product
Sunshine Photo Cart
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024PDF Invoices and Packing Slips For WooCommerce: Deserialization of Untrusted DataCVE-2024-30230 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.3.7.
Product
PDF Invoices and Packing Slips For WooCommerce
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update PDF Invoices and Packing Slips For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-30229 · WordPress plugins & themes · reported by PatchstackHigh 8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2.
Product
GiveWP
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Hercules Core: Deserialization of Untrusted DataCVE-2024-30228 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4.
Product
Hercules Core
Affected
up to 6.4
What to do
Affects up to 6.4. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Geo Controller: Deserialization of Untrusted DataCVE-2024-30227 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.
Product
Geo Controller
Affected
up to 8.6.4
What to do
Affects up to 8.6.4. Update Geo Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024BetterDocs: Deserialization of Untrusted DataCVE-2024-30226 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.
Product
BetterDocs
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024WP Migrate: Deserialization of Untrusted DataCVE-2024-30225 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.
Product
WP Migrate
Affected
up to 2.6.10
What to do
Affects up to 2.6.10. Update WP Migrate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024WholesaleX: Deserialization of Untrusted DataCVE-2024-30224 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2.
Product
WholesaleX
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WholesaleX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024ARMember: Deserialization of Untrusted DataCVE-2024-30223 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
Product
ARMember
Affected
up to 4.0.26
What to do
Affects up to 4.0.26. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024ARMember: Deserialization of Untrusted DataCVE-2024-30222 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.
Product
ARMember
Affected
up to 4.0.26
What to do
Affects up to 4.0.26. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Knowledge Base for Documentation, FAQs with AI Assistance: Deserialization of Untrusted DataCVE-2024-24842 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Echo Plugins Knowledge Base for Documentation, FAQs with AI Assistance.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through 11.30.2.
Product
Knowledge Base for Documentation, FAQs with AI Assistance
Affected
up to 11.30.2
What to do
Affects up to 11.30.2. Update Knowledge Base for Documentation, FAQs with AI Assistance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 26, 2024User Registration: Deserialization of Untrusted DataCVE-2023-27459 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Deserialization of Untrusted Data vulnerability in WPEverest User Registration.This issue affects User Registration: from n/a through 2.3.2.1.
Product
User Registration
Affected
up to 2.3.2.1
What to do
Affects up to 2.3.2.1. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2024Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/CVE-2024-24725 · Other software · gibbonedu · reported by MITREHigh 8.8
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
Product
gibbon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gibbonedu.org exploit-db.com
Mar 20, 2024 In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulCVE-2024-1800 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
Product
Telerik Report Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.telerik.com telerik.com
Mar 20, 2024Social Media Share Buttons: Deserialization of Untrusted DataCVE-2024-2721 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Buttons: from n/a through 2.1.0.
Product
Social Media Share Buttons
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Social Media Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024Tourfic: Deserialization of Untrusted DataCVE-2024-29136 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.
Product
Tourfic
Affected
up to 2.11.17
What to do
Affects up to 2.11.17. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2024 CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the applicaCVE-2024-2229 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.
Product
EcoStruxure Power Design - Ecodial
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Mar 7, 2024nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.CVE-2024-28212 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.
Product
nGrinder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.naver.com cve.naver.com
Mar 6, 2024Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specifCVE-2024-26580 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9673
Product
Apache InLong
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Feb 20, 2024Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization.CVE-2024-23114 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Product
Apache Camel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record camel.apache.org camel.apache.org
Feb 20, 2024Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.CVE-2024-22369 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.8
Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1
Product
Apache Camel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Feb 19, 2024cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format.CVE-2024-26134 · Other software · agronholm · reported by GitHubHigh 7.5
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Product
cbor2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 17, 2024Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.CVE-2023-52357 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 16, 2024Oracle Agile Product Lifecycle Management (PLM) Deserialization VulnerabilityCVE-2024-20953 · Other software · Oracle · reported by secalert_us@oracle.comExploitedHigh 8.8
Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.
Product
Agile Product Lifecycle Management (PLM)
On CISA’s list since
Feb 24, 2025 (federal fix deadline Mar 17, 2025)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com oracle.com
Feb 14, 2024Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enabCVE-2023-26592 · Other software · Intel · reported by secure@intel.comLow 3.8
Deserialization of untrusted data in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable a denial of service via local access.
Product
Thunderbolt DCH Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Feb 12, 2024Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookCVE-2024-23759 · Other software · Gambio · reported by MITRECritical 9.8
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.
Product
Gambio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record herolab.usd.de herolab.usd.de
Feb 12, 2024ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: Deserialization of Untrusted DataCVE-2024-23512 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4.
Product
ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024KD Coming Soon: Deserialization of Untrusted DataCVE-2023-46615 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
Product
KD Coming Soon
Affected
up to 1.7
What to do
Affects up to 1.7. Update KD Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Brooklyn | Creative Multi-Purpose Responsive: Deserialization of Untrusted DataCVE-2024-24926 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.
Product
Brooklyn | Creative Multi-Purpose Responsive
Affected
up to 4.9.7.6
What to do
Affects up to 4.9.7.6. Update Brooklyn | Creative Multi-Purpose Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024ERE Recently Viewed – Essential Real Estate Add-On: Deserialization of Untrusted DataCVE-2024-24797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essential Real Estate Add-On: from n/a through 1.3.
Product
ERE Recently Viewed – Essential Real Estate Add-On
Affected
up to 1.3
What to do
Affects up to 1.3. Update ERE Recently Viewed – Essential Real Estate Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –: Deserialization of Untrusted DataCVE-2024-24796 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.
Product
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently –
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024PropertyHive: Deserialization of Untrusted DataCVE-2024-23513 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5.
Product
PropertyHive
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 12, 2024Coupon Referral Program: Deserialization of Untrusted DataCVE-2024-25100 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Referral Program: from n/a before 1.8.4.
Product
Coupon Referral Program
Fixed in
1.8.4
What to do
Update Coupon Referral Program to 1.8.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 6, 2024Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artCVE-2024-24590 · Other software · Allegro.AI · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
Product
ClearML
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Feb 1, 2024IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializationCVE-2024-22320 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
Product
Operational Decision Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Jan 24, 2024ChatBot with AI: Deserialization of Untrusted DataCVE-2024-22309 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0.
Product
ChatBot with AI
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update ChatBot with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 24, 2024Asgaros Forum: Deserialization of Untrusted DataCVE-2024-22284 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.7.2.
Product
Asgaros Forum
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 22, 2024In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization.CVE-2017-20189 · Other software · Clojure · reported by MITRECritical 9.8
In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.
Product
Clojure
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record clojure.atlassian.net github.com
Jan 19, 2024Smart Slider 3: Deserialization of Untrusted DataCVE-2022-45845 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.
Product
Smart Slider 3
Affected
up to 3.5.1.9
What to do
Affects up to 3.5.1.9. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 19, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Deserialization of Untrusted DataCVE-2022-45083 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 9, 2024 A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges byCVE-2023-7032 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.
Product
Easergy Studio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jan 8, 2024HTML5 MP3 Player with Folder Feedburner Playlist Free: Deserialization of Untrusted DataCVE-2023-52202 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player with Folder Feedburner Playlist Free: from n/a through 2.8.0.
Product
HTML5 MP3 Player with Folder Feedburner Playlist Free
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update HTML5 MP3 Player with Folder Feedburner Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Page Builder: Live Composer: Deserialization of Untrusted DataCVE-2023-52206 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder.This issue affects Page Builder: Live Composer: from n/a through 1.5.25.
Product
Page Builder: Live Composer
Affected
up to 1.5.25
What to do
Affects up to 1.5.25. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024HTML5 SoundCloud Player with Playlist Free: Deserialization of Untrusted DataCVE-2023-52205 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free.This issue affects HTML5 SoundCloud Player with Playlist Free: from n/a through 2.8.0.
Product
HTML5 SoundCloud Player with Playlist Free
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update HTML5 SoundCloud Player with Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, MembCVE-2023-52200 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.
Affected
up to 4.0.22
What to do
Affects up to 4.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024HTML5 MP3 Player with Playlist Free: Deserialization of Untrusted DataCVE-2023-52207 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Playlist Free.This issue affects HTML5 MP3 Player with Playlist Free: from n/a through 3.0.0.
Product
HTML5 MP3 Player with Playlist Free
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update HTML5 MP3 Player with Playlist Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Deserialization of Untrusted DataCVE-2023-52225 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Gecka Terms Thumbnails: Deserialization of Untrusted DataCVE-2023-52219 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Gecka Gecka Terms Thumbnails.This issue affects Gecka Terms Thumbnails: from n/a through 1.1.
Product
Gecka Terms Thumbnails
Affected
up to 1.1
What to do
Affects up to 1.1. Update Gecka Terms Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Woocommerce Tranzila Payment Gateway: Deserialization of Untrusted DataCVE-2023-52218 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Anton Bond Woocommerce Tranzila Payment Gateway.This issue affects Woocommerce Tranzila Payment Gateway: from n/a through 1.0.8.
Product
Woocommerce Tranzila Payment Gateway
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Woocommerce Tranzila Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.