CVE-2026-39738

Published 30 October 2026 · tracked since 31 October 2026

Description

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-16760 HIGH 8.8
• CVE-2026-118938 HIGH 8.8
• CVE-2026-111578 HIGH 7.5
• CVE-2026-62990 HIGH 8.7
• CVE-2026-62989 HIGH 8.1
• CVE-2026-62864 HIGH 7.5
• CVE-2026-62958 HIGH 7.9
• CVE-2026-62297 HIGH 7.5
• CVE-2026-62847 HIGH 8.2
• CVE-2026-58412 HIGH 8.2

→ Open the live CVE board · all tools