Insecure deserialization.

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

• Insecure deserialization

>=3.2.0, <=3.2.4 || >=4.0.0, <4.0.2 · fixed in 4.0.2

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

• Insecure deserialization
• CWE-184

>=2.10.0, <2.18.8 || >=3.0.0, <3.1.4 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 3.1.4, 2.21.4

Duplicate Advisory: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

• Insecure deserialization

<0.0.33 · fixed in 0.0.33

Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

• Insecure deserialization

<0.0.28 · fixed in 0.0.28

Duplicate Advisory: Picklescan has a missing detection when calling built-in python profile.Profile.runctx

• Insecure deserialization

<0.0.29 · fixed in 0.0.29

Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

• Insecure deserialization

<0.0.29 · fixed in 0.0.29

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

• Insecure deserialization

Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution

• Insecure deserialization

<4.5.5 · fixed in 4.5.5

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

• Insecure deserialization

<5.1.1 · fixed in 5.1.1

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

• Code injection
• Insecure deserialization

<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 · fixed in 2025.3.3, 2025.4.4, 2026.0.3

Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config

• Insecure deserialization

<0.0.28 · fixed in 0.0.28

Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx

• Insecure deserialization

<0.0.30 · fixed in 0.0.30

Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand

• Insecure deserialization

<0.0.30 · fixed in 0.0.30

zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization

• zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台
• Insecure deserialization
• CWE-20

Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

• joomshaper.net SP LMS extension for Joomla
• Insecure deserialization

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

• Insecure deserialization

<8.2.1 · fixed in 8.2.1

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

• Insecure deserialization
• CWE-676

<1.12.2 · fixed in 1.12.2

pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

• pgadmin.org pgAdmin 4
• Authentication bypass
• Insecure deserialization

Deserialization vulnerability in ibaPDA and ibaDatCoordinator

• ibaPDA
• ibaDatCoordinator
• Insecure deserialization

Remote Code Execution (RCE) vulnerability in Windchill PDMlink

• PTC Windchill PDMLink
• PTC FlexPLM
• Insecure deserialization
• CWE-20

Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call

• Insecure deserialization

* · no fixed version yet

Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing

• Insecure deserialization

<0.0.33 · fixed in 0.0.33

NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API

• nv-tlabs GEN3C
• Insecure deserialization

WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability

• EMV Creatify
• Insecure deserialization

WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability

• EMV The Hospital
• Insecure deserialization

WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability

• Themeton The Barber Shop
• Insecure deserialization

WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

• Themeton Lagom
• Insecure deserialization

WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability

• park_of_ideas Moderno
• Insecure deserialization

WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability

• Mikado-Themes Château
• Insecure deserialization

WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability

• Mikado-Themes Zoya
• Insecure deserialization

WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability

• Select-Themes Manufaktur Solutions
• Insecure deserialization

WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability

• Edge-Themes Eldon
• Insecure deserialization

WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability

• Mikado-Themes ShiftUp
• Insecure deserialization

WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability

• Elated-Themes SingleMalt
• Insecure deserialization

WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

• Select-Themes Hiroshi
• Insecure deserialization

WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability

• Elated-Themes Konsept
• Insecure deserialization

WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability

• PressLayouts Alukas
• Insecure deserialization

WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability

• PressLayouts PressMart
• Insecure deserialization

WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability

• Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme
• Insecure deserialization

WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability

• ThemeREX Plumbing
• Insecure deserialization

WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability

• ThemeREX Reisen
• Insecure deserialization

Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation

• Quanos Solutions GmbH SCHEMA ST4
• Insecure deserialization

WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability

• Melapress WP Activity Log
• Insecure deserialization

WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

• Jetimpex Inc. JetEngine
• Insecure deserialization

WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

• Thrive Themes Thrive Apprentice
• Insecure deserialization

WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

• Jetimpex Inc. JetEngine
• Insecure deserialization

WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

• jwsthemes AI Lab
• Insecure deserialization

WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability

• Mikado-Themes EasyMeals
• Insecure deserialization

WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

• Edge-Themes Reina
• Insecure deserialization

WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability

• Barn2 Media Ltd WooCommerce Product Filters
• Insecure deserialization

WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

• Select-Themes Mildhill
• Insecure deserialization

WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

• Select-Themes Zermatt
• Insecure deserialization

WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability

• VeronaLabs Slimstat Analytics
• Insecure deserialization

WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability

• ThemeREX Group ThemeREX Addons
• Insecure deserialization

Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import

• wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
• Insecure deserialization

WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

• Edge-Themes Valeska
• Insecure deserialization

WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

• Edge-Themes Behold
• Insecure deserialization

WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability

• Mikado-Themes Esmée
• Insecure deserialization

WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

• Elated-Themes Léonie
• Insecure deserialization

WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability

• Mikado-Themes TechLink
• Insecure deserialization