CVE & CISA-KEV Catalog

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it

Published 2026-10-30

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

Published 2026-10-30

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

Published 2026-10-29

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

Published 2026-10-29

Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Published 2026-10-29

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Published 2026-10-29

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Published 2026-10-29

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Published 2026-10-29

Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

Published 2026-10-29

Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

Published 2026-10-29

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

Published 2026-10-29

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

Published 2026-10-29

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

Published 2026-10-29

Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

Published 2026-10-29

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

Published 2026-10-29

Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

Published 2026-10-29

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

Published 2026-10-29

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

Published 2026-10-29

Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

Published 2026-10-29

Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

Published 2026-10-29

Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

Published 2026-10-29

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

Published 2026-10-29

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

Published 2026-10-29

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

Published 2026-10-29

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

Published 2026-10-29

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.

Published 2026-10-29