Insecure deserialization.

PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files

• PyMoDAQ
• pymodaq_data
• Code injection
• Insecure deserialization

h5io before 0.2.6 Arbitrary Code Execution via read_hdf5

• h5io
• Code injection
• Insecure deserialization

ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution

• francescopace espectre
• Insecure deserialization

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Insecure deserialization

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

• MLflow
• Insecure deserialization

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

• MLflow
• Insecure deserialization

Report Deserialization Code Execution

• Perforce Puppet Enterprise
• Code injection
• Insecure deserialization

Stanza: RCE via pickle deserialization in the lemmatizer

• Code injection
• Insecure deserialization

>=1.14.0, <1.15.0 · fixed in 1.15.0

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution

• Insecure deserialization
• CWE-913

<2025.1.18 || >=2026.0.1-preview, <2026.0.25 || >=2026.1.0-preview, <2026.1.19 · fixed in 2025.1.18, 2026.0.25, 2026.1.19

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

• NIST labbench
• Insecure deserialization

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

• themefic Ultra Addons for Contact Form 7
• Insecure deserialization

jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization

• jxxghp MoviePilot
• Insecure deserialization
• CWE-20

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

• Apache Software Foundation Apache MINA
• Insecure deserialization

PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

• addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder
• Insecure deserialization

OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

• opensearch-project sql
• Insecure deserialization

Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

• trailofbits fickling
• Insecure deserialization
• CWE-706

Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

• trailofbits fickling
• Insecure deserialization
• CWE-693

WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

• Stylemix MasterStudy LMS
• Insecure deserialization

WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability

• RexTheme Product Feed Manager
• Insecure deserialization

WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability

• LeadSnap
• Insecure deserialization

WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability

• GS Plugins GS Testimonial Slider
• Insecure deserialization

WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

• ShortPixel Enable Media Replace
• Insecure deserialization

WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability

• Aman FunnelKit Automations
• Insecure deserialization

WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

• ThemeREX Royal Event
• Insecure deserialization

Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

• frappe lms
• Insecure deserialization

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

• InternLM lmdeploy
• Insecure deserialization

Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution

• Google Cloud Application Integration
• Insecure deserialization

Chamilo LMS: Database-backed PHP object injection in career deserialization

• chamilo-lms
• Insecure deserialization

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

• Gravity Forms
• Insecure deserialization

Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

• Enable Media Replace
• Insecure deserialization

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

• Drupal Single Content Sync
• Insecure deserialization

Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center

• Veeam Management Pack for Microsoft System Center
• Insecure deserialization

Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center

• Veeam Management Pack for Microsoft System Center
• Insecure deserialization

Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

• unclecode crawl4ai
• Insecure deserialization

WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

• 10Web Social Photo Feed
• Insecure deserialization

WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

• Social Snap
• Insecure deserialization

WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

• FolioVision FV Flowplayer Video Player
• Insecure deserialization

WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

• Product Catalog Feed by PixelYourSite
• Insecure deserialization

WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

• Fast Themes Sastra Essential Addons for Elementor
• Insecure deserialization

WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

• Frisbii Pay
• Insecure deserialization

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

• dbarrere WP Media folders
• Insecure deserialization

WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

• Daman Jeet Finale Lite
• Insecure deserialization

WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

• blazethemes News Kit Elementor Addons
• Insecure deserialization

WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

• myPOS Payments myPOS Checkout
• Insecure deserialization

WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

• BuddyDev BuddyPress Xprofile Custom Field Types
• Insecure deserialization

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

• sosidee Dynamic QR Code &#8211; generator
• Insecure deserialization

WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

• Dotstore Extra Fees Plugin for WooCommerce
• Insecure deserialization

WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

• Gesundheit Bewegt GmbH Zippy
• Insecure deserialization

WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

• Arni Cinco WPCargo Track & Trace
• Insecure deserialization

WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

• Zoho Flow
• Insecure deserialization

WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

• ThemeREX Gunslinger
• Insecure deserialization

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

• ThemeREX Good Homes
• Insecure deserialization

WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

• ThemeREX Gamic
• Insecure deserialization

WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

• ThemeREX Gamezone
• Insecure deserialization

WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

• ThemeREX EmojiNation
• Insecure deserialization

WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

• ThemeREX Edge Decor
• Insecure deserialization

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

• ThemeREX Coinpress
• Insecure deserialization

WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

• ThemeREX Bonbon
• Insecure deserialization

WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

• ThemeREX Avventure
• Insecure deserialization

WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

• ThemeREX Filmax
• Insecure deserialization