CVE-2026-94065

HighCVSS 8.8/10Last modified Oct 11, 2026

Description

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-940667.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XS CVE-2026-940678.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux CVE-2026-94079.8A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewa CVE-2026-940746.5Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.CVE-2026-940759.8Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affect CVE-2026-940768.8Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.CVE-2026-940776.5Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.CVE-2026-940787.1Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-940795.3Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94089.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file CVE-2026-940805.3Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-940817.1Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.