high8.7
CVE-2026-63393
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
opensearch-project · sql
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
141 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high8.8
CVE-2026-118938
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
trailofbits · fickling
high8.8
CVE-2026-16760
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
trailofbits · fickling
high7.3
CVE-2026-62848
Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
metalama · Metalama
high8.8
CVE-2026-118090
WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Stylemix · MasterStudy LMS
high7.2
CVE-2026-118089
WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
RexTheme · Product Feed Manager
critical9.8
CVE-2026-90888
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
leadsnap · LeadSnap
high8.8
CVE-2026-78527
WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
GS Plugins · GS Testimonial Slider
high8.8
CVE-2026-73186
WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
ShortPixel · Enable Media Replace
critical9.8
CVE-2026-39738
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
FunnelKit · FunnelKit Automations
critical9.8
CVE-2026-119526
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
ThemeREX · Royal Event
medium5.3
CVE-2026-61803
Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
frappe · lms
critical9.8
CVE-2026-119706
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
InternLM · lmdeploy
critical9.4
CVE-2026-93327
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
Google Cloud · Application Integration
high7.5
CVE-2026-45145
Chamilo LMS: Database-backed PHP object injection in career deserialization
chamilo · chamilo-lms
critical9.8
CVE-2026-103039
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
Gravity Forms · Gravity Forms
high7.5
CVE-2026-114422
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
Unknown · Enable Media Replace
high8.7
CVE-2026-107238
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam…
Veeam · Management Pack for Microsoft System Center
critical9.3
CVE-2023-22793
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service…
Veeam · Management Pack for Microsoft System Center
high7.7
CVE-2026-119120
Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
unclecode · crawl4ai
high8.8
CVE-2026-118081
WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
10Web · 10Web Social Photo Feed
high8.8
CVE-2026-118080
WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
Social Snap · Social Snap
high7.2
CVE-2026-118079
WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability
FolioVision · FV Flowplayer Video Player
high7.2
CVE-2026-118078
WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
PixelYourSite · Product Catalog Feed by PixelYourSite
high7.2
CVE-2026-118077
WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
Fast Themes · Sastra Essential Addons for Elementor
high8.8
CVE-2026-118076
WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Frisbii · Frisbii Pay
high8.8
CVE-2026-118075
WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
dbarrere · WP Media folders
high7.2
CVE-2026-118074
WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Daman Jeet · Finale Lite
high8.8
CVE-2026-118073
WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
blazethemes · News Kit Elementor Addons
high7.2
CVE-2026-116869
WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
myPOS Payments · myPOS Checkout