CVE-2026-65883
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field all
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 29 jul 2026 · Última mod.: 29 jul 2026 · CWE-502
Sin historial EPSS suficiente todavía.
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-581637.5 ALT—
——0Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.7hCVE-2026-149748.1 ALT—
——0IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.20hCVE-2026-145129.8 CRÍ—
——0IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.20hCVE-2026-667139.8 CRÍ—
——0Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
(only when Tribes clustering is enabled, which is off by default) allows an
unauthenticated remote attacker with network access to the clustering port to
execute arbitrary code via a crafted serialized Java object delivered to the cluster
channel and deserialized in
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are
recommended to upgrade to version 2.0.1, which fixes this issue by removing the
clustering feature entirely.12hCVE-2026-1175610.0 CRÍ36.9%
——11A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.1dCVE-2026-656178.8 ALT22.8%
——7A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.2d