CVE-2026-78292

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

Published Aug 27, 2026
CVSS 9.8 critical
0.6% chance of exploitation in the next 30 days (EPSS)

Affected software

hashthemes Hash Form

CVE-2026-78292 at the National Vulnerability Database