Insecure deserialization.

GLPI Database Inventory Plugin Vulnerable to Stored Object Injection

• pluginsGLPI databaseinventory
• Insecure deserialization

Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization

• Insecure deserialization

>=1.20.0, <2.7.0 · fixed in 2.7.0

Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow

• Genymobile scrcpy
• Insecure deserialization

WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability

• magepeopleteam Booking and Rental Manager
• Insecure deserialization

WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability

• BoldThemes Codiqa
• Insecure deserialization

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability

• BoldGrid Client Invoicing by Sprout Invoices
• Insecure deserialization

WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability

• TieLabs Jannah
• Insecure deserialization

WordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability

• CRM Perks WP Gravity Forms Salesforce
• Insecure deserialization

WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability

• CRM Perks WP Gravity Forms HubSpot
• Insecure deserialization

WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability

• CRM Perks WP Gravity Forms Constant Contact Plugin
• Insecure deserialization

WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability

• CRM Perks WP Gravity Forms Zoho CRM and Bigin
• Insecure deserialization

WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability

• CRM Perks WP Gravity Forms Insightly
• Insecure deserialization

WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability

• CRM Perks WP Gravity Forms FreshDesk Plugin
• Insecure deserialization

WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

• add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder
• Insecure deserialization

WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

• add-ons.org PDF Invoice Builder for WooCommerce
• Insecure deserialization

WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

• add-ons.org PDF for WPForms
• Insecure deserialization

WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

• add-ons.org PDF for Contact Form 7
• Insecure deserialization

WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

• add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder
• Insecure deserialization

WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability

• BoldThemes DentiCare
• Insecure deserialization

An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07).

• Insecure deserialization

An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28).

• Insecure deserialization

Deserialization of untrusted data in NVIDIA Isaac Lab

• NVIDIA Isaac Lab
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Framework

• NVIDIA NeMo Framework
• Insecure deserialization

Fickling has Code Injection vulnerability via pty.spawn()

• Code injection
• Insecure deserialization

<0.1.6 · fixed in 0.1.6

Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list

• Insecure deserialization
• CWE-184

<0.1.6 · fixed in 0.1.6

Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

• Hitachi Vantara Pentaho Data Integration and Analytics
• Insecure deserialization

Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versions

• Insecure deserialization

<=1.46.1 · no fixed version yet

MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool.

• Insecure deserialization

tiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization

• tiny-rdm Tiny RDM
• Insecure deserialization
• CWE-20

Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import

• unitecms Doubly – Cross Domain Copy Paste for WordPress
• Insecure deserialization

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

• Denial of service
• Insecure deserialization

>=13.3.1-canary.0, <14.2.35 || >=15.0.6, <15.0.7 || >=15.1.10, <15.1.11 || >=15.2.7, <15.2.8 || >=15.3.7, <15.3.8 || >=15.4.9, <15.4.10 || >=15.5.8, <15.5.9 || >=15.6.0-canary.59, <15.6.0-canary.60 || >=16.0.9, <16.0.10 || >=16.1.0-canary.17, <16.1.0-canary.19 · fixed in 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

• Information disclosure
• Insecure deserialization

<0.5.7 · fixed in 0.5.7

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

• Denial of service
• Insecure deserialization

<0.5.7 · fixed in 0.5.7

Denial of Service Vulnerability in React Server Components

• Denial of service
• Insecure deserialization

>=19.0.2, <19.0.3 || >=19.1.3, <19.1.4 || >=19.2.2, <19.2.3 · fixed in 19.0.3, 19.1.4, 19.2.3

Apache HugeGraph-Server: RAFT and deserialization vulnerability

• Insecure deserialization

<1.7.0 · fixed in 1.7.0

Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie

• rodgerholl Visitor Logic Lite
• Insecure deserialization

Next Server Actions Source Code Exposure

• Information disclosure
• Insecure deserialization

>=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17 · fixed in 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17

Next Vulnerable to Denial of Service with Server Components

• Denial of service
• Insecure deserialization

>=13.3.0, <14.2.34 || >=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17 · fixed in 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17

Denial of Service Vulnerability in React Server Components

• Denial of service
• Insecure deserialization

>=19.0.0, <19.0.2 || >=19.1.0, <19.1.3 || >=19.2.0, <19.2.2 · fixed in 19.0.2, 19.1.3, 19.2.2

Source Code Exposure Vulnerability in React Server Components

• Information disclosure
• Insecure deserialization

>=19.0.0, <19.0.2 || >=19.1.0, <19.1.3 || >=19.2.0, <19.2.2 · fixed in 19.0.2, 19.1.3, 19.2.2

Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE

• Barracuda Networks RMM
• Insecure deserialization

Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload

• Google Cloud Cloud Data Fusion
• Insecure deserialization

ColdFusion | Deserialization of Untrusted Data (CWE-502)

• Adobe ColdFusion
• Insecure deserialization

Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)

• wearefrank ladybug
• Insecure deserialization

Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE

• Entrust Corporation Instant Financial Issuance (IF)
• Authentication bypass
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NVTabular

• NVIDIA NVTabular
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Merlin Transformers4Rec

• NVIDIA Merlin Transformers4Rec
• Insecure deserialization

WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability

• Flipper Code - WordPress Development Company WP Maps
• Insecure deserialization

Deserialization Vulnerability in SAP jConnect - SDK for ASE

• SAP_SE SAP jConnect - SDK for ASE
• Insecure deserialization

Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)

• Insecure deserialization

<6.0.0 · fixed in 6.0.0

HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.

• Insecure deserialization

UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection

• UNA CMS
• Insecure deserialization

React Server Components are Vulnerable to RCE

• Insecure deserialization

<0.5.3 · fixed in 0.5.3

React Server Components are Vulnerable to RCE

• Insecure deserialization

>=19.0.0, <19.0.1 || >=19.1.0, <19.1.2 || >=19.2.0, <19.2.1 · fixed in 19.0.1, 19.1.2, 19.2.1

Next.js is vulnerable to RCE in React flight protocol

• Insecure deserialization

>=14.3.0-canary.77, <15.0.5 || >=15.1.0-canary.0, <15.1.9 || >=15.2.0-canary.0, <15.2.6 || >=15.3.0-canary.0, <15.3.6 || >=15.4.0-canary.0, <15.4.8 || >=15.5.0-canary.0, <15.5.7 || >=16.0.0-canary.0, <16.0.7 · fixed in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

CODESYS Development System - Deserialization of Untrusted Data

• CODESYS Development System
• Insecure deserialization

NutzBoot vulnerable to deserialization

• Insecure deserialization
• CWE-20

<=2.6.0-SNAPSHOT · no fixed version yet

Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

• favethemes Houzez
• Insecure deserialization

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

• Command injection
• Insecure deserialization

<=0.9.2 · no fixed version yet