Insecure deserialization.

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

• Insecure deserialization

>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11 · fixed in 4.0.6, 3.3.16

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

• Insecure deserialization

>=2.0.0, <2.0.6 || >=1.2.0, <1.2.18 || <=1.1.17 · fixed in 2.0.6, 1.2.18

Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository

• Insecure deserialization

>=7.0.0, <7.0.6 · fixed in 7.0.6

Deserialization of untrusted data in Veeam Backup and Replication

• Veeam Backup and Replication
• Insecure deserialization

Microsoft SharePoint Server Spoofing Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Elevation of Privilege Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Nuance PowerScribe Remote Code Execution Vulnerability

• Microsoft Nuance PowerScribe 360 4.0
• Microsoft Nuance PowerScribe 360 version 4.0.1
• Insecure deserialization

Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field

• creativethemeshq Blocksy
• Insecure deserialization

Spring Framework Unsafe Deserialization via Jackson JMS Converters

• Insecure deserialization

<=5.3.39 || >=6.0.0, <=6.1.21 || >=6.2.0, <6.2.19 || >=7.0.0-M1, <7.0.8 · fixed in 6.2.19, 7.0.8

PHPSpreadsheet has a patch bypass for CVE-2026-34084

• Insecure deserialization

<1.30.5 · fixed in 1.30.5

LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload

• thimpress LearnPress – Backup & Migration Tool
• Insecure deserialization

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

• codepress Admin Columns
• Insecure deserialization

OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

• Insecure deserialization
• Denial of service

>=32.0.0, <37.0.0 · fixed in 37.0.0

Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

• Insecure deserialization

<1.1.0 · fixed in 1.1.0

Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service

• Seagull Software, LLC. BarTender 2021
• Insecure deserialization

Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

• Seagull Software, LLC. BarTender 2010
• Seagull Software, LLC. BarTender 2016
• Authentication bypass
• Insecure deserialization

Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components

• Insecure deserialization

<9.5.2 · fixed in 9.5.2

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

• Insecure deserialization

>=7.0.0, <7.14.2 · fixed in 7.14.2

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<3.14.0 · fixed in 3.14.0

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

• Insecure deserialization

>=2.2.0, <2.2.8 || >=2.1.0, <2.1.13 || <2.0.29 · fixed in 2.2.8, 2.1.13, 2.0.29

Deserialization of untrusted data in NVIDIA NVTabular

• NVIDIA NVTabular
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NVTabular

• NVIDIA NVTabular
• Insecure deserialization

WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability

• Elated-Themes Askka
• Insecure deserialization

WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

• Elated-Themes Töbel
• Insecure deserialization

WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

• Elated-Themes Aperitif
• Insecure deserialization

FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()

• Insecure deserialization
• CWE-20

<=0.8.2 · no fixed version yet

IBM WebSphere Application Server is affected by remote code execution

• IBM WebSphere Application Server
• Insecure deserialization

IBM WebSphere Application Server is affected by a remote code execution vulnerability

• IBM WebSphere Application Server
• Insecure deserialization

AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization

• ROCm aiter
• Insecure deserialization

Logback vulnerable to Object Injection through HardenedObjectInputStream modules

• Insecure deserialization

<1.5.34 · fixed in 1.5.34

Apache Airflow Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=3.2.0, <3.2.2 · fixed in 3.2.2

A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names...

• Insecure deserialization

>=3.2.0, <3.2.2 · fixed in 3.2.2

Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x throu…

• Dassault Systèmes Teamwork Cloud - Standard Edition
• Dassault Systèmes Teamwork Cloud - Business Edition
• Insecure deserialization

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files.

• Insecure deserialization

manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model

• zyddnys manga-image-translator
• Insecure deserialization

WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection

• sbthemes WooCommerce Infinite Scroll and Ajax Pagination
• Insecure deserialization

QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability

• Insecure deserialization

<1.5.33 · fixed in 1.5.33

An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java component

• Insecure deserialization

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

• Insecure deserialization
• Information disclosure

<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12

RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization

• inducer relate
• Insecure deserialization

Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

• Insecure deserialization

<11.5.17 || >=12.0.0-RC1, <12.3.7 || >=2026.1.0, <2026.1.3 · fixed in 11.5.17, 12.3.7, 2026.1.3

Jenkins LDAP Plugin deserializes data from LDAP referrals without validation

• Insecure deserialization

<807.809.vd3a · fixed in 807.809.vd3a

Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

• Insecure deserialization

<2.41.1 · fixed in 2.41.1

Deserialization of untrusted data in NVIDIA Merlin Transformers4Rec

• NVIDIA Merlin Transformers4Rec
• Insecure deserialization

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

• Mirasvit Full Page Cache Warmer for Magento 2
• Insecure deserialization

TCC-TRANSACTION has an Improper Input Validation vulnerability

• Insecure deserialization
• CWE-20

<=2.1.0 · no fixed version yet

HuggingFace transformers vulnerable to remote code execution

• Insecure deserialization
• CWE-1066

<5.3.0 · fixed in 5.3.0

Microsoft Planetary Computer Pro Information Disclosure Vulnerability

• Microsoft Planetary Computer Pro (GeoCatalog)
• Insecure deserialization

Microsoft SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Concrete CMS Vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

<9.5.1 · fixed in 9.5.1

Apache Fory PyFory Deserialization of Untrusted Data

• Insecure deserialization

>=0.13.0, <1.0.0 · fixed in 1.0.0

Deserialization of untrusted data in NVIDIA BioNeMo Framework

• NVIDIA BioNeMo Framework
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie

• PixelYourSite Boost
• Insecure deserialization

Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)

• Insecure deserialization

<7.0.7 · fixed in 7.0.7

APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

• Insecure deserialization

>=4.0.0a1, <=4.0.0a6 · no fixed version yet

ModelScope is vulnerable to arbitrary code injection via a crafted module

• Code injection
• Insecure deserialization

<1.27.0 · fixed in 1.27.0

HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal

• hestiacp
• Insecure deserialization