tag
Gadget-Chain
Critical
Roundcube Webmail Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113)
CVE-2025-49113·
Roundcube Webmail
unpatched
Critical
Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)
CVE-2025-54068·
Laravel Livewire (versions prior to v3.6.4)
unpatched
Critical
GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)
CVE-2025-22777·
GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs)
patched
Critical
Apache Camel `camel-consul` ConsulRegistry Deserialization RCE (CVE-2026-27172)
CVE-2026-27172·
Apache Camel camel-consul component (org.apache.camel.component.consul.ConsulRegistry)
unpatched
Critical
WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806
CVE-2026-54806·
WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress
patched
Critical
SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)
CVE-2026-48909 (GHSA-gf8c-xmwj-whrh)·
JoomShaper SP LMS (com_splms) Joomla Learning Management System extension
patched
Critical
OpenAM Pre-Authentication RCE via `jato.clientSession` Deserialization (CVE-2026-33439)
CVE-2026-33439·
ForgeRock / OpenIdentityPlatform OpenAM
unpatched
Critical
Group-Office PHP Deserialization Remote Code Execution (CVE-2026-34838)
CVE-2026-34838 (GHSA-h22j-frrf-5vxq)·
Group-Office groupware suite
patched
Critical
Apache Tomcat Tribes EncryptInterceptor Fail-Open Unauthenticated RCE (CVE-2026-34486)
CVE-2026-34486·
Apache Tomcat Tribes clustering (EncryptInterceptor)
patched
Critical
Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779)
CVE-2026-42779·
Apache MINA (mina-core)
unpatched