Mmastodon TechnologyCybersecurity first seen 12 h ago, last 12 h ago, peak #6

Critical unauthenticated vulnerability found in BoldThemes Avala plugin

Original: 🚨 EUVD-2026-96489 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Avala 🏢 Vendor: boldthemes 📅 Updated: 2026-10-10 📝 Unauthentica

A critical vulnerability, EUVD-2026-96489, has been catalogued affecting Avala, a product by vendor BoldThemes. The flaw is rated 9.8 out of 10 on the CVSS v3.1 scale and involves unauthenticated PHP object injection, meaning attackers would not need credentials to exploit it. It was updated in the EU vulnerability database on 10 October 2026. Administrators running Avala are being urged to review the advisory and patch promptly.

Why now: A maximum-severity, unauthenticated flaw in a widely used theme vendor's product demands immediate attention from site administrators.

BoldThemesAvalaENISAEUVD-2026-96489

Open on mastodon →

Rank over time, top of the chart is #1. 2 snapshots from 12 h ago to 12 h ago.

Evidence

• 🚨 EUVD-2026-96489 📊 Score: 9.8/10 (CVSS v3.1) 📦 Product: Avala 🏢 Vendor: boldthemes 📅 Updated: 2026-10-10 📝 Unauthenticated PHP Object Injection in Avala 🔗 https:// euvd.enisa.europa.eu/vulnerabi lity/EUVD-2026-96489 # cybersecurity # infosec # euvd # cve # vulnerability · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/1777493