CVE-2026-93941

{
  "etk_id": "ETK-2026-1153",
  "cve_id": "CVE-2026-93941",
  "display_id": "CVE-2026-93941",
  "ghsa_id": "GHSA-66j7-cgjc-vfw6",
  "euvd_id": "EUVD-2026-96189",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Object injection through unsafe deserialization in Edema",
  "summary": "Edema versions through 1.2.2.2 are affected by unsafe deserialization that can permit object injection. The supplied advisory metadata indicates an attacker does not need authentication or user interaction to exploit the issue.",
  "mitigation": "Restrict access to affected Edema installations and disable or remove the component where feasible. Monitor for a vendor update and upgrade promptly when a fixed release is published.",
  "vendor": "themerex group",
  "product": "Edema",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.2.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "edema",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0033,
  "epss_percentile": 0.2485,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 27.3770995,
  "t0_at": "2026-10-10T07:00:37.796000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-10T07:00:37.796000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:00:37.796000+00:00",
      "url": "https://github.com/advisories/GHSA-66j7-cgjc-vfw6"
    }
  }
}