Insecure deserialization.

Deserialization of untrusted data in NVIDIA FLARE SDK

• NVIDIA FLARE SDK
• Insecure deserialization

Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.

• Insecure deserialization

An issue was discovered in Cista v0.15 and below.

• Insecure deserialization

Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

• Insecure deserialization

>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6 · fixed in 2.0.28, 2.1.11, 2.2.6

Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1 · fixed in 4.14.6, 4.18.1

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=4.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.7, 4.18.2, 4.20.0

Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

• Insecure deserialization
• CWE-1173

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1 · fixed in 4.14.6, 4.18.1

Camel-MINA Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.6, 4.18.2, 4.20.0

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

• Insecure deserialization

>=3.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.14.7, 4.18.2, 4.20.0

Apache MINA vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6 · fixed in 2.0.28, 2.1.11, 2.2.6

Camel-PQC Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<4.18.2 || >=4.19.0, <4.20.0 · fixed in 4.18.2, 4.20.0

k8sGPT has Prompt Injection through its k8sGPT-Operator

• Insecure deserialization
• Broken access control

<0.4.32 · fixed in 0.4.32

Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

• Code injection
• Insecure deserialization

>=2.49.0, <2.55.0 · fixed in 2.55.0

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

• Insecure deserialization
• CWE-693

<4.0.3.1 || >=4.0.4, <4.0.4.1 || >=5.0.0, <6.0.1.1 || >=6.0.2, <6.0.4 · fixed in 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4

Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=3.2.0, <3.3.1 · fixed in 3.3.1

Microsoft Bing Remote Code Execution Vulnerability

• Microsoft Bing
• Insecure deserialization

KTransformers Unsafe Deserialization RCE via balance_serve

• kvcache-ai ktransformers
• Insecure deserialization

LeRobot Unsafe Deserialization Remote Code Execution via gRPC

• Hugging Face LeRobot
• Insecure deserialization

camel-infinispan Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<4.20.0 · fixed in 4.20.0

Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Insecure deserialization

Information disclosure in Oracle Corporation Oracle Java SE and others

• Oracle Corporation Oracle Java SE
• Oracle Corporation Oracle GraalVM for JDK
• Information disclosure
• Insecure deserialization

OpenMage LTS: Phar Deserialization leads to Remote Code Execution

• Insecure deserialization

<20.17.0 · fixed in 20.17.0

WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability

• Responsive Slider by MetaSlider
• Insecure deserialization

Apache Airflow allows code execution through crafted XCom payloads

• Insecure deserialization

<3.2.0 · fixed in 3.2.0

Firebird has a buffer overflow when parsing corrupted slice packets

• firebird
• Memory corruption
• Insecure deserialization

DataEase: Quartz Deserialization → Remote Code Execution

• dataease
• Insecure deserialization

KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value

• Digital Knowledge KnowledgeDeliver
• Hard-coded credentials
• Insecure deserialization

Deserialization of untrusted data in OpenText, Inc RightFax

• OpenText, Inc RightFax
• Insecure deserialization

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

• Adobe Connect
• Adobe Connect Desktop Application
• Insecure deserialization

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

• Adobe Connect
• Adobe Connect Desktop Application
• Insecure deserialization

Azure Monitor Agent Elevation of Privilege Vulnerability

• Microsoft Azure Monitor
• Insecure deserialization

Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability

• Microsoft HPC Pack 2019
• Insecure deserialization

Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection

• shapedplugin Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts
• Insecure deserialization

Pachno 1.0.6 FileCache Deserialization Remote Code Execution

• Pachno
• Insecure deserialization

Keras has an untrusted deserialization vulnerability

• Insecure deserialization

<3.13.2 · fixed in 3.13.2

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly ...

• Insecure deserialization

>=3.1.8, <3.2.0 · fixed in 3.2.0

Apache Storm: Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<2.8.6 · fixed in 2.8.6

Deserialization of untrusted data in Samsung Open Source Escargot

• Samsung Open Source Escargot
• Insecure deserialization
• Memory corruption

Next.js has a Denial of Service with Server Components

• Denial of service
• Insecure deserialization

>=13.0.0, <15.5.15 || >=16.0.0-beta.0, <16.2.3 · fixed in 15.5.15, 16.2.3

React Server Components have a Denial of Service Vulnerability

• Denial of service
• Insecure deserialization

>=19.0.0, <19.0.5 || >=19.1.0, <19.1.6 || >=19.2.0, <19.2.5 · fixed in 19.0.5, 19.1.6, 19.2.5

Session Cache Restore — Arbitrary Free via Deserialized Pointer

• wolfSSL
• Insecure deserialization

Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

• Sonatype Nexus Repository
• Insecure deserialization

Mirror-registry: remote code execution using pickle deserialization

• mirror registry for Red Hat OpenShift 2.0
• Red Hat Quay 3.10
• Insecure deserialization

Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

• wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
• Insecure deserialization

IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file

• IBM Langflow Desktop
• Insecure deserialization

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

• Authentication bypass
• Insecure deserialization

>=2.0.0, <2.1.2 · fixed in 2.1.2

MONAI: Unsafe functions lead to pickle deserialization rce

• Insecure deserialization

<1.6.0 · fixed in 1.6.0

Deserialization of untrusted data in NVIDIA DALI

• NVIDIA DALI
• Insecure deserialization

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

• Insecure deserialization

<16.0.6 · fixed in 16.0.6

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

• Insecure deserialization

<5.0.0rc3 · fixed in 5.0.0rc3

pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization

• pytries datrie
• Insecure deserialization
• CWE-20

FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization

• FedML
• Insecure deserialization
• CWE-20

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

• Insecure deserialization
• Broken access control

<=0.5.0b3 · no fixed version yet

NASA cFS Pickle pickle.load deserialization

• NASA cFS
• Insecure deserialization
• CWE-20

Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

• Insecure deserialization

>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

• Code injection
• Insecure deserialization

<1.3.0 · fixed in 1.3.0

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

• Intermesh groupoffice
• Insecure deserialization

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.

• Privilege escalation
• Insecure deserialization

OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2

• Insecure deserialization

<2.10.2 · fixed in 2.10.2

Replicator deserializes untrusted user input

• Insecure deserialization

<=1.0.5 · no fixed version yet