CVE-2026-43642
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that al
CVSS
8.1
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 22, 2026 · Last modified: Sep 22, 2026 · CWE-502
Not enough EPSS history yet.
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.
- www.virtualizor.comhttps://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
- www.virtualizor.comhttps://www.virtualizor.com/blog/virtualizor-3-3-0/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/softaculous-virtualizor-php-object-injection-via-billing-module-handler
- www.vulncheck.comhttps://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-83803——
——0Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process. Self-hosted installations using the default configuration are not affected because the relocation feature is disabled by default. This issue is fixed in version 26.7.0.2hCVE-2026-836038.4 HIG—
——0Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data to pickle.loads(), allowing attacker-controlled code to execute as root on systems with fail2ban-client installed. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.2hCVE-2026-95806——
——0MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.
The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences:
- any filesystem operation on a caller-influenced path that resolves to a phar archive triggers an implicit unserialize() call, creating a deserialization sink;
- a relocated application root can reach executable code inside an uploaded phar file, enabling arbitrary code execution as the web user.
No component of MISP, the vendored CakePHP framework, or any runtime-loaded library reads or constructs phar archives. The wrapper therefore serves no legitimate purpose in the MISP runtime and exists solely as an available primitive for an attacker who can influence a filesystem path argument.4hCVE-2026-930889.8 CRI—
——0SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.1hCVE-2026-651798.8 HIG—
——0NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.53mCVE-2026-651787.8 HIG—
——0NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.53m