CVE-2026-78533

CriticalCVSS 9.8/10Last modified Oct 13, 2026

Description

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-785347.1Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.CVE-2026-785359.8Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.CVE-2026-785366.5Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.CVE-2026-78549.8A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the CVE-2026-785418.5A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacCVE-2026-785437.5IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1CVE-2026-785457.2The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsCVE-2026-785464.8Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current CVE-2026-785474.4Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2CVE-2026-78557.2A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the compCVE-2026-785507.2The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SCVE-2026-785518.8RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid user