ChangeIntelIT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-115190Published

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restric…

Recorded JSON

cve-program · CVE-2026-115190

Published

mautic/core

https://packagist.org

Original vendor version evidence · not evaluated as a NuGet range

{
                    "collectionURL": "https://packagist.org",
                    "packageName": "mautic/core",
                    "repo": "https://github.com/mautic/mautic",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "2.15.2",
                            "lessThan": "5.2.12",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "6.0.0",
                            "lessThan": "6.0.10",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0",
                            "lessThan": "7.2.0",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }