CVE-2026-78265

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-782666.5Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.CVE-2026-782679.8Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.CVE-2026-782687.5Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLCVE-2026-782696.4Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.CVE-2026-78278.1A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) CVE-2026-782707.6Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.CVE-2026-782717.2Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.CVE-2026-782725.4Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.CVE-2026-782736.5Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-782749.1Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-782756.8Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-782767.2Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78265: Critical severity, CVSS 9.8 | Vulnix