CVE-2026-103348
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This i
CVSS
7.2
High
EPSS
0.4%
p29
KEV
—
Exploit Today
9
0-100
Published: Oct 5, 2026 · Last modified: Oct 6, 2026 · CWE-502
Not enough EPSS history yet.
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-934477.5 HIG—
——0IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.2hCVE-2026-651427.8 HIG—
——0NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.5hCVE-2026-103831——
——0CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.12hCVE-2026-397979.8 CRI24.9%
——7Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.12hCVE-2026-1047478.1 HIG15.9%
——5Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.12hCVE-2026-829887.5 HIG17.9%
——5There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint12h