CVE-2026-119516

{
  "etk_id": "ETK-2026-3706",
  "cve_id": "CVE-2026-119516",
  "display_id": "CVE-2026-119516",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-117999",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in Radius Booking",
  "summary": "Radius Booking, Booking Calendar for Appointments & Services through version 1.0.20 is affected by unsafe deserialization. An unauthenticated remote attacker may be able to cause object injection where the vulnerable functionality is reachable.",
  "mitigation": "Disable the Radius Booking plugin on affected installations until the vendor provides an updated release. If it must remain enabled, restrict access to the installation and exposed booking functionality to trusted networks and users.",
  "vendor": "Mamunur Rashid",
  "product": "Radius Booking — Booking Calendar for Appointments & Services",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.0.20"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "radius-booking",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.40385768333333333,
  "t0_at": "2026-11-06T08:00:31.536000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T08:20:54.882813+00:00",
      "days": 0.014159106631944444,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T08:00:31.536000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-06T08:00:31.536000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T08:00:31.536000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119516"
    }
  }
}