CVE-2026-93945

{
  "etk_id": "ETK-2026-1145",
  "cve_id": "CVE-2026-93945",
  "display_id": "CVE-2026-93945",
  "ghsa_id": "GHSA-4236-v7g9-hpxg",
  "euvd_id": "EUVD-2026-96185",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in Axiomthemes Balance",
  "summary": "Axiomthemes Balance versions through 1.12.0 are affected by unsafe handling of untrusted serialized data. An attacker able to supply data to the affected deserialization path may trigger object injection; the advisory does not identify the specific exposed interface or endpoint.",
  "mitigation": "Restrict or disable any externally reachable functionality that accepts serialized input until an updated release is available. Limit access to affected Balance installations to trusted users and networks where possible.",
  "vendor": "Axiomthemes",
  "product": "Balance",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.12.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "balance",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0033,
  "epss_percentile": 0.2485,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 26.37624565,
  "t0_at": "2026-10-10T07:00:38.671000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T08:35:02.625884+00:00",
      "days": 0.06555503337962963,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:00:38.671000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T07:00:38.671000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:00:38.671000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93945"
    }
  }
}