Patch Forecast
Amber warning
Patch this week.

CVE-2026-54856

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Risk score
74/100
CVSS
9.8 v3.1
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
RexCoin versions up to 1.2.6 have an unauthenticated PHP Object Injection vulnerability, allowing an attacker to potentially inject malicious PHP code, leading to high impact.
Affected
{'products': ['RexCoin'], 'packages': [], 'versions': ['<= 1.2.6']}
Fix
Check the linked advisory for a fix, as none is provided in this record.
Exploitation
No known exploitation

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: php

References

Original description

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Last activity 29 Oct 2026. Patch Forecast updates every hour.