Vulnerabilities
Critical Deserialization Flaw in Square Squash Allows Remote Code Execution
An unauthenticated attacker can trigger arbitrary Ruby code execution in Square Squash by storing crafted YAML data via a public API endpoint.
CWE-502
Everything Threat Times has reported about CWE-502: 15 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw Rated Critical in Kalles CMS
A critical vulnerability in Kalles CMS versions up to 1.1.7.1 allows unauthenticated attackers to inject PHP objects, posing significant security risks.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in Avala Plugin
The National Vulnerability Database lists CVE-2026-62077 as a critical severity issue affecting BoldThemes Avala versions up to 1.1.4.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in WineShop <= 3.20
The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.
Vulnerabilities
Critical Deserialization Flaw Found in Travesia WordPress Theme Through Version 1.1.16
The National Vulnerability Database lists a CVSS 9.8 critical object injection vulnerability in ThemeREX Group Travesia, affecting versions up to 1.1.16.
Vulnerabilities
Critical Deserialization Flaw Found in ThemeREX Rosalinda WordPress Theme
A CVSS 9.8 vulnerability in the Rosalinda theme allows object injection, affecting versions up to 1.2.4 according to the National Vulnerability Database.
Vulnerabilities
Critical Object Injection Vulnerability Found in Smart Casa Versions Up to 1.0.12
The National Vulnerability Database rates CVE-2026-93932 as critical with a CVSS score of 9.8, affecting ThemeREX Group’s Smart Casa software through version 1.0.12 due to unsafe data deserialization.
Vulnerabilities
ThemeREX Smash Plugin Faces Critical Deserialization Flaw in Versions Up to 1.12.0
The National Vulnerability Database lists CVE-2026-93931 as critical, exposing users of older Smash plugin versions to remote object injection risks.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Tantra CMS Versions Up to 2.9.0
The National Vulnerability Database rates CVE-2026-93930 as critical, citing untrusted data deserialization risks in the popular web platform.
Vulnerabilities
Critical Deserialization Flaw in ThemeREX IPharm Plugin Rated 9.8
A severe object injection vulnerability in the IPharm WordPress plugin affects versions up to 1.2.4, allowing attackers to execute arbitrary code on affected sites.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Partiso Theme
A CVSS 9.8 vulnerability in Partiso versions up to 1.1.13 allows untrusted data deserialization and object injection, posing a severe risk to affected sites.
Vulnerabilities
Critical Deserialization Flaw in ThemeREX Greeny Theme Rated 9.8 CVSS
A critical object injection vulnerability in the Greeny WordPress theme allows remote attackers to execute arbitrary code on affected sites through untrusted data.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Convex Plugin
The National Vulnerability Database lists a CVSS 9.8 critical deserialization issue in ThemeREX Convex versions up to 1.16.0.
Vulnerabilities
Critical CVE-2026-93942 Allows Object Injection in ThemeREX Dwell Up to Version 1.16.0
The National Vulnerability Database lists a critical deserialization flaw in ThemeREX Dwell, affecting versions through 1.16.0 with a CVSS score of 9.8.
Vulnerabilities
Critical RCE Flaw in IBM Security Verify Access Allows Unauthenticated Code Execution
A severe vulnerability in IBM access management software enables remote attackers to execute arbitrary code without credentials, posing immediate risk to exposed systems.