Deserialization of Untrusted Data
CWE-502 · 401 records · 112 with a public proof-of-concept
Records the NVD classes as Deserialization of Untrusted Data (CWE-502), highest CVSS first.
- CRITICAL 10CVE-2026-70416
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
objectscale
- CRITICAL 9.9CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediat…
- CRITICAL 9.9CVE-2026-20307
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at le…
- CRITICAL 9.8CVE-2026-124079public PoC
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Ho…
- CRITICAL 9.8CVE-2026-119516
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: fro…
- CRITICAL 9.8CVE-2026-92190
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentic…
- CRITICAL 9.8CVE-2026-102435
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated atta…
- CRITICAL 9.8CVE-2026-118636
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.…
- CRITICAL 9.8CVE-2026-109220
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the…
- CRITICAL 9.8CVE-2026-90888
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
- CRITICAL 9.8CVE-2026-39738
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
- CRITICAL 9.8CVE-2026-119526
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
- CRITICAL 9.8CVE-2026-119706public PoC
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle…
- CRITICAL 9.8CVE-2026-103039
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unre…
- CRITICAL 9.8CVE-2026-62131
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
- CRITICAL 9.8CVE-2026-62018
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
- CRITICAL 9.8CVE-2026-62017
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
- CRITICAL 9.8CVE-2026-62016
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
- CRITICAL 9.8CVE-2026-62015
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
- CRITICAL 9.8CVE-2026-62014
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
- CRITICAL 9.8CVE-2026-62013
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
- CRITICAL 9.8CVE-2026-62012
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
- CRITICAL 9.8CVE-2026-62011
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
- CRITICAL 9.8CVE-2026-62010
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
- CRITICAL 9.8CVE-2026-62009
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
- CRITICAL 9.8CVE-2026-62008
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
- CRITICAL 9.8CVE-2026-62006
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
- CRITICAL 9.8CVE-2026-62005
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
- CRITICAL 9.8CVE-2026-62004
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
- CRITICAL 9.8CVE-2026-62003
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
- CRITICAL 9.8CVE-2026-62002
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
- CRITICAL 9.8CVE-2026-62001
Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
- CRITICAL 9.8CVE-2026-61998
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
- CRITICAL 9.8CVE-2026-61997
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
- CRITICAL 9.8CVE-2026-61992
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
- CRITICAL 9.8CVE-2026-54860
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
- CRITICAL 9.8CVE-2026-54859
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
- CRITICAL 9.8CVE-2026-54858
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
- CRITICAL 9.8CVE-2026-54857
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
- CRITICAL 9.8CVE-2026-54856
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
- CRITICAL 9.8CVE-2026-115968
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
- CRITICAL 9.8CVE-2026-110879public PoC
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument…
- CRITICAL 9.8CVE-2026-94075
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
- CRITICAL 9.8CVE-2026-114196
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
- CRITICAL 9.8CVE-2026-115806
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An…
- CRITICAL 9.8CVE-2026-112859
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
- CRITICAL 9.8CVE-2026-112858
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
- CRITICAL 9.8CVE-2026-112857
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
- CRITICAL 9.8CVE-2026-112856
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
- CRITICAL 9.8CVE-2026-112855
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
- CRITICAL 9.8CVE-2026-112854
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
- CRITICAL 9.8CVE-2026-112853
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
- CRITICAL 9.8CVE-2026-112851
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
- CRITICAL 9.8CVE-2026-112848
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
- CRITICAL 9.8CVE-2026-112847
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
- CRITICAL 9.8CVE-2026-112846
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
- CRITICAL 9.8CVE-2026-112862
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
- CRITICAL 9.8CVE-2026-110886
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
- CRITICAL 9.8CVE-2026-104736
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through s…
- CRITICAL 9.8CVE-2026-104730
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthe…
- CRITICAL 9.8CVE-2026-109686
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
- CRITICAL 9.8CVE-2026-55573public PoC
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The in…
- CRITICAL 9.8CVE-2026-108291
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
- CRITICAL 9.8CVE-2026-49950public PoC
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidat…
- CRITICAL 9.8CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
- CRITICAL 9.8CVE-2026-78535
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
- CRITICAL 9.8CVE-2026-78533
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
- CRITICAL 9.8CVE-2026-78531
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
- CRITICAL 9.8CVE-2026-78529
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
- CRITICAL 9.8CVE-2026-66569
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
- CRITICAL 9.8CVE-2026-66568
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
- CRITICAL 9.8CVE-2026-66567
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
- CRITICAL 9.8CVE-2026-66565
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
- CRITICAL 9.8CVE-2026-66564
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
- CRITICAL 9.8CVE-2026-66563
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
- CRITICAL 9.8CVE-2026-66483
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
- CRITICAL 9.8CVE-2026-66482
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
- CRITICAL 9.8CVE-2026-62125
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
- CRITICAL 9.8CVE-2026-62124
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
- CRITICAL 9.8CVE-2026-62123
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
- CRITICAL 9.8CVE-2026-62120
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
- CRITICAL 9.8CVE-2026-62090
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
- CRITICAL 9.8CVE-2026-62087
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
- CRITICAL 9.8CVE-2026-62086
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
- CRITICAL 9.8CVE-2026-62077
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
- CRITICAL 9.8CVE-2026-62076
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
- CRITICAL 9.8CVE-2026-62054
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
- CRITICAL 9.8CVE-2026-62053
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
- CRITICAL 9.8CVE-2026-62052
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
- CRITICAL 9.8CVE-2026-62051
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
- CRITICAL 9.8CVE-2026-62050
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
- CRITICAL 9.8CVE-2026-42723
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
- CRITICAL 9.8CVE-2026-42719
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
- CRITICAL 9.8CVE-2026-42718
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
- CRITICAL 9.8CVE-2026-42716
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
- CRITICAL 9.8CVE-2026-104398
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.
- CRITICAL 9.8CVE-2026-93945
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
- CRITICAL 9.8CVE-2026-93944
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
- CRITICAL 9.8CVE-2026-93943
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- CRITICAL 9.8CVE-2026-93942
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- CRITICAL 9.8CVE-2026-93941
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- CRITICAL 9.8CVE-2026-93940
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- CRITICAL 9.8CVE-2026-93938
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- CRITICAL 9.8CVE-2026-93937
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- CRITICAL 9.8CVE-2026-93936
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- CRITICAL 9.8CVE-2026-93935
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- CRITICAL 9.8CVE-2026-93934
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- CRITICAL 9.8CVE-2026-93933
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- CRITICAL 9.8CVE-2026-93932
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- CRITICAL 9.8CVE-2026-93931
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- CRITICAL 9.8CVE-2026-93930
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- CRITICAL 9.8CVE-2026-93929
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- CRITICAL 9.8CVE-2026-93927
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
- CRITICAL 9.8CVE-2026-62046
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- CRITICAL 9.8CVE-2026-62045
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- CRITICAL 9.8CVE-2026-100730public PoC
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this i…
- CRITICAL 9.8CVE-2026-88131
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- CRITICAL 9.8CVE-2026-78406
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
security verify access · security verify access container · verify identity access · verify identity access container
- CRITICAL 9.8CVE-2026-78401
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
security verify access · security verify access container · verify identity access · verify identity access container
- CRITICAL 9.8CVE-2026-93034public PoC
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists…
- CRITICAL 9.8CVE-2026-95606
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
- CRITICAL 9.8CVE-2026-105192public PoC
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which c…
- CRITICAL 9.8CVE-2026-76750
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
- CRITICAL 9.8CVE-2026-39797
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
- CRITICAL 9.8CVE-2026-97283
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
- CRITICAL 9.8CVE-2026-37719
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
- CRITICAL 9.8CVE-2026-103877
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java class, allowing some pot…
- CRITICAL 9.8CVE-2026-100512
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
- CRITICAL 9.8CVE-2026-103395public PoC
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __re…
- CRITICAL 9.8CVE-2026-97248
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
- CRITICAL 9.8CVE-2026-102455
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CRITICAL 9.8CVE-2026-103041public PoC
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service priv…
- CRITICAL 9.8CVE-2026-103040public PoC
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execut…
- CRITICAL 9.8CVE-2026-82384public PoC
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, …
- CRITICAL 9.8CVE-2026-96560public PoC
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious…
- CRITICAL 9.8CVE-2026-18163
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
- CRITICAL 9.8CVE-2026-93088public PoC
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame …
- CRITICAL 9.8CVE-2026-19658
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is…
- CRITICAL 9.8CVE-2026-94301
The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch…
- CRITICAL 9.8CVE-2025-59953public PoC
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core …
- CRITICAL 9.8CVE-2026-91939public PoC
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object inject…
- CRITICAL 9.8CVE-2026-61484
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find…
lucy
- CRITICAL 9.8CVE-2026-70554public PoC
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowli…
- CRITICAL 9.8CVE-2026-69098public PoC
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can …
- CRITICAL 9.1CVE-2026-47168public PoC
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the appl…
- CRITICAL 9.1CVE-2017-20285public PoC
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of …
- CRITICAL 9.1CVE-2026-55083public PoC
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Ja…
- CRITICAL 9CVE-2026-103693
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP o…
- HIGH 8.8CVE-2026-111421public PoC
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API s…
- HIGH 8.8CVE-2026-87112
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling uns…
- HIGH 8.8CVE-2026-16760public PoC
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, w…
- HIGH 8.8CVE-2026-118938public PoC
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level functi…
- HIGH 8.8CVE-2026-78527
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
- HIGH 8.8CVE-2026-73186
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
- HIGH 8.8CVE-2026-118090
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
- HIGH 8.8CVE-2026-118081
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
- HIGH 8.8CVE-2026-118080
Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
- HIGH 8.8CVE-2026-118076
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
- HIGH 8.8CVE-2026-118075
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
- HIGH 8.8CVE-2026-118073
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
- HIGH 8.8CVE-2026-116868
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
- HIGH 8.8CVE-2026-116867
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
- HIGH 8.8CVE-2026-116866
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
- HIGH 8.8CVE-2026-104324
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
langflow
- HIGH 8.8CVE-2026-117624
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass…
jenkins
- HIGH 8.8CVE-2026-117612
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.
jenkins
- HIGH 8.8CVE-2026-116389
Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.
- HIGH 8.8CVE-2026-116391
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.
- HIGH 8.8CVE-2026-1928
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possibl…
- HIGH 8.8CVE-2026-75891
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due…
- HIGH 8.8CVE-2026-57845public PoC
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pick…
- HIGH 8.8CVE-2026-113779public PoC
The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated se…
- HIGH 8.8CVE-2026-110370
Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest: from n/a through 1.9.2.
- HIGH 8.8CVE-2026-110369
Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team Members – GS Plugins: from n/a through 2.8.2.
- HIGH 8.8CVE-2026-82814
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() duri…
- HIGH 8.8CVE-2026-113404
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
- HIGH 8.8CVE-2026-88900public PoC
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for e…
- HIGH 8.8CVE-2026-78165public PoC
Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSeria…
- HIGH 8.8CVE-2026-111408
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- HIGH 8.8CVE-2026-107436
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.
- HIGH 8.8CVE-2026-110761public PoC
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence s…
- HIGH 8.8CVE-2026-106599
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
- HIGH 8.8CVE-2026-65674
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-87697
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-85900
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
sharepoint server
- HIGH 8.8CVE-2026-83520
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-70035
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-100214
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
- HIGH 8.8CVE-2026-12613
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS a…
- HIGH 8.8CVE-2026-52903
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dial…
- HIGH 8.8CVE-2026-62021
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
- HIGH 8.8CVE-2026-105885
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
- HIGH 8.8CVE-2026-104723
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers,…
- HIGH 8.8CVE-2026-94065
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
- HIGH 8.8CVE-2026-94064
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
- HIGH 8.8CVE-2026-104392
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- HIGH 8.8CVE-2026-105436
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
- HIGH 8.8CVE-2026-95534
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a t…
- HIGH 8.8CVE-2026-106558public PoC
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or i…
backstage plugin-techdocs-node · backstage
- HIGH 8.8CVE-2026-97188
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated …
- HIGH 8.8CVE-2026-97257
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
- HIGH 8.8CVE-2026-100511
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
- HIGH 8.8CVE-2026-97284
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
- HIGH 8.8CVE-2026-97291
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
- HIGH 8.8CVE-2026-102377
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
- HIGH 8.8CVE-2026-96831
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
- HIGH 8.8CVE-2026-95531
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
- HIGH 8.8CVE-2026-94683
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
- HIGH 8.8CVE-2026-94678
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
- HIGH 8.8CVE-2026-94121
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
- HIGH 8.8CVE-2026-94076
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
- HIGH 8.8CVE-2026-82093
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
- HIGH 8.8CVE-2026-96804
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- HIGH 8.8CVE-2026-96775
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- HIGH 8.8CVE-2026-18490
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-n…
- HIGH 8.8CVE-2026-17637
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
- HIGH 8.8CVE-2026-67615public PoC
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass…
- HIGH 8.8CVE-2026-28325
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
- HIGH 8.8CVE-2026-65179public PoC
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, de…
- HIGH 8.8CVE-2026-71281public PoC
Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft'…
- HIGH 8.4CVE-2026-12389
A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.
- HIGH 8.4CVE-2026-116499
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
- HIGH 8.4CVE-2026-83603public PoC
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The a…
- HIGH 8.2CVE-2026-93905
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
- HIGH 8.2CVE-2026-47623public PoC
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.
dynamo · linux kernel
- HIGH 8.1CVE-2026-104738
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to …
- HIGH 8.1CVE-2026-104317
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
langflow
- HIGH 8.1CVE-2026-112852
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
- HIGH 8.1CVE-2026-114403public PoC
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFac…
- HIGH 8.1CVE-2026-97296
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
- HIGH 8.1CVE-2026-111094
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
teamcity
- HIGH 8.1CVE-2026-109237public PoC
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env refe…
- HIGH 8.1CVE-2026-109391public PoC
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication…
- HIGH 8.1CVE-2026-104747
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
- HIGH 8.1CVE-2026-104905public PoC
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. At…
- HIGH 8.1CVE-2026-102101public PoC
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution…
- HIGH 8.1CVE-2026-43642
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act …
- HIGH 8.1CVE-2026-76834public PoC
b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys. Unauthenticated attackers can submit c…
- HIGH 8CVE-2026-115190public PoC
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP class…
- HIGH 8CVE-2026-104932
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. …
- HIGH 8CVE-2026-75941
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
- HIGH 7.9CVE-2026-73793
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
- HIGH 7.8CVE-2026-120859public PoC
PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by …
- HIGH 7.8CVE-2026-120499public PoC
h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with bui…
- HIGH 7.8CVE-2026-102739public PoC
ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior to 3.0.0-rc1, Micro-ESPectre analysis tools, including tools/6_optimize_filter_params.py, tools/1_analyze_raw_data.py, and tools/10_train_ml_model.py, load NPZ datasets with NumPy pickle support enab…
- HIGH 7.8CVE-2026-118627
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerabili…
- HIGH 7.8CVE-2026-118623
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulner…
- HIGH 7.8CVE-2026-115878public PoC
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/train…
- HIGH 7.8CVE-2026-120833public PoC
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file o…
- HIGH 7.8CVE-2026-118617
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit th…
- HIGH 7.8CVE-2026-118613
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerabil…
- HIGH 7.8CVE-2026-91483
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastruc…
- HIGH 7.8CVE-2026-91460
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to th…
- HIGH 7.8CVE-2026-91459
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to th…
- HIGH 7.8CVE-2026-96186
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-88091
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-87692
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-65180public PoC
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, infor…
- HIGH 7.8CVE-2026-65110public PoC
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, …
- HIGH 7.8CVE-2026-65142public PoC
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- HIGH 7.8CVE-2026-100308public PoC
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model di…
- HIGH 7.8CVE-2026-100845public PoC
MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execut…
monai
- HIGH 7.8CVE-2026-100843public PoC
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system comm…
monai
- HIGH 7.8CVE-2026-100841public PoC
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). …
monai
- HIGH 7.8CVE-2026-65178public PoC
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and infor…
- HIGH 7.8CVE-2026-24267public PoC
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalat…
nemo speech
- HIGH 7.8CVE-2026-24239public PoC
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.
nemo speech
- HIGH 7.7CVE-2026-12544
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution ch…
- HIGH 7.6CVE-2026-100846public PoC
MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If…
monai
- HIGH 7.6CVE-2026-71294public PoC
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restri…
- HIGH 7.5CVE-2026-104010
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter param…
- HIGH 7.5CVE-2026-10859
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due t…
- HIGH 7.5CVE-2026-45145public PoC
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_…
- HIGH 7.5CVE-2026-114422
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a…
- HIGH 7.5CVE-2026-119120public PoC
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with …
- HIGH 7.5CVE-2026-115912public PoC
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory mu…
vllm
- HIGH 7.5CVE-2026-113356public PoC
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to …
- HIGH 7.5CVE-2026-12148
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
mq operator · supplied mq advanced container images
- HIGH 7.5CVE-2026-112304public PoC
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to …
- HIGH 7.5CVE-2026-111160public PoC
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parame…
- HIGH 7.5CVE-2026-105442
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
- HIGH 7.5CVE-2026-109360public PoC
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from…
- HIGH 7.5CVE-2026-82627
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This make…
- HIGH 7.5CVE-2026-93447
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with …
langflow
- HIGH 7.5CVE-2026-82988
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoi…
- HIGH 7.5CVE-2026-80513
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chai…
- HIGH 7.5CVE-2026-91827
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP…
- HIGH 7.5CVE-2026-85017
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level acc…
- HIGH 7.4CVE-2026-114724public PoC
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no…
- HIGH 7.4CVE-2026-105013
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
sharepoint server
- HIGH 7.3CVE-2026-62848public PoC
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can b…
- HIGH 7.3CVE-2026-116580public PoC
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine int…
- HIGH 7.3CVE-2026-109361public PoC
MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_inf…
- HIGH 7.3CVE-2019-25777public PoC
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts t…
- HIGH 7.3CVE-2026-97865public PoC
A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be ini…
- HIGH 7.2CVE-2026-124318public PoC
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an Updat…
- HIGH 7.2CVE-2026-118089
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
- HIGH 7.2CVE-2026-42701
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
- HIGH 7.2CVE-2026-118079
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
- HIGH 7.2CVE-2026-118078
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
- HIGH 7.2CVE-2026-118077
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
- HIGH 7.2CVE-2026-118074
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
- HIGH 7.2CVE-2026-116869
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
- HIGH 7.2CVE-2026-116865
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
- HIGH 7.2CVE-2026-116864
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
- HIGH 7.2CVE-2026-116390
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a throug…
- HIGH 7.2CVE-2026-115590
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
- HIGH 7.2CVE-2026-116392
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
- HIGH 7.2CVE-2026-114704
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
- HIGH 7.2CVE-2026-114624public PoC
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchang…
- HIGH 7.2CVE-2026-29001public PoC
TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized b…
- HIGH 7.2CVE-2026-104734
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, …
- HIGH 7.2CVE-2026-97278
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
- HIGH 7.2CVE-2026-104764
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level acce…
- HIGH 7.2CVE-2026-62130
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
- HIGH 7.2CVE-2026-62044
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
- HIGH 7.2CVE-2026-94676
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
- HIGH 7.2CVE-2026-106606
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
- HIGH 7.2CVE-2026-12626
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for aut…
- HIGH 7.2CVE-2026-105872
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
- HIGH 7.2CVE-2026-94568
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
- HIGH 7.2CVE-2026-93617
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- HIGH 7.2CVE-2026-103348
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
- HIGH 7.2CVE-2026-100506
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
- HIGH 7.2CVE-2026-103349
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
- HIGH 7.2CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
- HIGH 7.2CVE-2026-102108public PoC
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of…
- HIGH 7.2CVE-2026-97256
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
- HIGH 7.2CVE-2026-102392
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
- HIGH 7.2CVE-2026-96833
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
- HIGH 7.2CVE-2026-96832
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
- HIGH 7.2CVE-2026-96344
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
- HIGH 7.2CVE-2026-96343
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
- HIGH 7.2CVE-2026-94677
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
- HIGH 7.2CVE-2026-94122
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
- HIGH 7.2CVE-2026-93771
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
- HIGH 7.2CVE-2026-93651
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
- HIGH 7.2CVE-2026-93624
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
- HIGH 7.2CVE-2026-84862
IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.
- HIGH 7.2CVE-2026-95603
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
- MEDIUM 6.6CVE-2026-81344
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators…
- MEDIUM 6.6CVE-2026-110874public PoC
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations o…
- MEDIUM 6.6CVE-2026-102135public PoC
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway s…
- MEDIUM 6.6CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object I…
- MEDIUM 6.5CVE-2026-12350
IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.
mq operator · supplied mq advanced container images
- MEDIUM 6.5CVE-2026-12155
IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.
mq operator · supplied mq advanced container images
- MEDIUM 6.3CVE-2026-116230public PoC
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Up…
plague inc evolved
- MEDIUM 6.3CVE-2026-116098public PoC
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation…
ravenfield
- MEDIUM 6.3CVE-2026-112086public PoC
A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It …
- MEDIUM 6.3CVE-2026-112081public PoC
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deser…
- MEDIUM 6.3CVE-2026-112079public PoC
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is…
- MEDIUM 6.3CVE-2026-111868public PoC
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possib…
- MEDIUM 6.3CVE-2026-108958public PoC
A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The at…
- MEDIUM 6.3CVE-2026-94093public PoC
A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attac…
- MEDIUM 6.2CVE-2026-116500
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.
- MEDIUM 5.8CVE-2026-36471public PoC
Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload s…
- MEDIUM 5.6CVE-2026-96745public PoC
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring s…
- MEDIUM 5.5CVE-2026-95928public PoC
A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserializa…
- MEDIUM 5.5CVE-2026-95897public PoC
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has…
- MEDIUM 5.5CVE-2026-94092public PoC
A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now…
- MEDIUM 5.5CVE-2026-94091public PoC
A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the …
- MEDIUM 5.4CVE-2026-117613
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g., stored cross-site…
jenkins
- MEDIUM 5.3CVE-2026-108947public PoC
A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launc…
- MEDIUM 5CVE-2026-111628public PoC
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in i…
- MEDIUM 4.9CVE-2026-97246
Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
- MEDIUM 4.7CVE-2026-120320public PoC
A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserializ…
- MEDIUM 4.7CVE-2026-86841
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-m…
- MEDIUM 4.1CVE-2026-97869public PoC
A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulati…
- LOW 3.4CVE-2026-63630public PoC
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs …
- UNSCOREDCVE-2026-96285public PoC
Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes per…
- UNSCOREDCVE-2026-86829public PoC
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the …
- UNSCOREDCVE-2026-82436
Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever…
- UNSCOREDCVE-2026-82337public PoC
Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to…
- UNSCOREDCVE-2026-111395public PoC
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler r…
- UNSCOREDCVE-2026-115731
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by subm…
- UNSCOREDCVE-2026-63393public PoC
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `curs…
- UNSCOREDCVE-2026-61803public PoC
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course o…
- UNSCOREDCVE-2026-93327
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted seria…
- UNSCOREDCVE-2026-118562
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- UNSCOREDCVE-2026-107238
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
- UNSCOREDCVE-2023-22793
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
- UNSCOREDCVE-2025-30047
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local net…
- UNSCOREDCVE-2026-114608public PoC
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherw…
- UNSCOREDCVE-2026-16477
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it;…
- UNSCOREDCVE-2026-114198public PoC
Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility
- UNSCOREDCVE-2026-114197public PoC
Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility
- UNSCOREDCVE-2026-90799
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- UNSCOREDCVE-2026-78162public PoC
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instance…
- UNSCOREDCVE-2026-64610
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, whic…
- UNSCOREDCVE-2026-47218public PoC
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deseria…
- UNSCOREDCVE-2026-102469public PoC
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.…
- UNSCOREDCVE-2026-102554public PoC
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSe…
- UNSCOREDCVE-2026-107104
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functiona…
- UNSCOREDCVE-2025-64393
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- UNSCOREDCVE-2026-103831
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the c…
- UNSCOREDCVE-2026-103441
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
- UNSCOREDCVE-2026-13046
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the s…
- UNSCOREDCVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the…
- UNSCOREDCVE-2026-81867
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared pr…
- UNSCOREDCVE-2026-83803public PoC
Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user …
- UNSCOREDCVE-2026-95806public PoC
MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a …