Total
1805 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-39356 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through 3.2. | |||||
| CVE-2025-32928 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in ThemeGoods Altair allows Object Injection.This issue affects Altair: from n/a through 5.2.2. | |||||
| CVE-2025-32927 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery allows Object Injection.This issue affects FoodBakery: from n/a through 3.3. | |||||
| CVE-2025-47581 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Elbisnero WordPress Events Calendar Registration & Tickets allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through 2.6.0. | |||||
| CVE-2025-39410 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8. | |||||
| CVE-2025-47582 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0. | |||||
| CVE-2025-39349 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop allows Object Injection.This issue affects CiyaShop: from n/a through 4.18.0. | |||||
| CVE-2025-39354 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference allows Object Injection.This issue affects Grand Conference: from n/a through 5.2. | |||||
| CVE-2025-39348 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant WordPress allows Object Injection.This issue affects Grand Restaurant WordPress: from n/a through 7.0. | |||||
| CVE-2025-48018 | 2025-05-21 | N/A | 7.5 HIGH | ||
| An authenticated user can modify application state data. | |||||
| CVE-2025-47277 | 2025-05-21 | N/A | 9.8 CRITICAL | ||
| vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `PyNcclPipe` KV cache transfer integration with the V0 engine. No other configurations are affected. vLLM supports the use of the `PyNcclPipe` class to establish a peer-to-peer communication domain for data transmission between distributed nodes. The GPU-side KV-Cache transmission is implemented through the `PyNcclCommunicator` class, while CPU-side control message passing is handled via the `send_obj` and `recv_obj` methods on the CPU side. The intention was that this interface should only be exposed to a private network using the IP address specified by the `--kv-ip` CLI parameter. The vLLM documentation covers how this must be limited to a secured network. The default and intentional behavior from PyTorch is that the `TCPStore` interface listens on ALL interfaces, regardless of what IP address is provided. The IP address given was only used as a client-side address to use. vLLM was fixed to use a workaround to force the `TCPStore` instance to bind its socket to a specified private interface. As of version 0.8.5, vLLM limits the `TCPStore` socket to the private interface as configured. | |||||
| CVE-2025-48200 | 2025-05-21 | N/A | 10.0 CRITICAL | ||
| The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. | |||||
| CVE-2025-4803 | 2025-05-21 | N/A | 7.2 HIGH | ||
| The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | |||||
| CVE-2022-2903 | 1 Ninjaforms | 1 Ninja Forms | 2025-05-21 | N/A | 7.2 HIGH |
| The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. | |||||
| CVE-2024-5488 | 1 Seopress | 1 Seopress | 2025-05-21 | N/A | 9.8 CRITICAL |
| The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. | |||||
| CVE-2025-0767 | 1 Melapress | 1 Wp Activity Log | 2025-05-21 | N/A | 9.8 CRITICAL |
| WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php. | |||||
| CVE-2025-47732 | 1 Microsoft | 1 Dataverse | 2025-05-21 | N/A | 8.7 HIGH |
| Microsoft Dataverse Remote Code Execution Vulnerability | |||||
| CVE-2022-40314 | 1 Moodle | 1 Moodle | 2025-05-20 | N/A | 9.8 CRITICAL |
| A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. | |||||
| CVE-2025-30384 | 1 Microsoft | 1 Sharepoint Server | 2025-05-19 | N/A | 7.4 HIGH |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. | |||||
| CVE-2025-24661 | 2025-05-19 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 1.1.8. | |||||