Insecure deserialization.

AD-Security AD_Miner Cache analyse_cache.py request_a deserialization

• AD-Security AD_Miner
• Insecure deserialization
• CWE-20

kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization

• kirilkirkov Ecommerce-CodeIgniter-Bootstrap
• Insecure deserialization
• CWE-20

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because ...

• Insecure deserialization
• CWE-184

<0.1.11 · fixed in 0.1.11

Keras: Lambda deserialization can bypass safe mode and execute code

• Insecure deserialization

<3.12.3 || >=3.13.0, <3.15.0 · fixed in 3.12.3, 3.15.0

WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization

• WatchGuard Fireware OS
• Insecure deserialization

WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability

• Themify Popup
• Insecure deserialization

WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability

• Novalnet Payment Gateway for WooCommerce
• Insecure deserialization

WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability

• Arraytics Booktics
• Insecure deserialization

WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability

• Fuelthemes Werkstatt
• Insecure deserialization

WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability

• Repute Infosystems ARMember Premium
• Insecure deserialization

RCE via Deserialization in AWS Advanced JDBC Wrapper

• AWS Advanced JDBC Wrapper
• Insecure deserialization

Remote Code Execution via Unsafe Deserialization in LogItem Import

• Wikimedia Foundation MediaWiki
• Code injection
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron-Bridge

• NVIDIA Megatron-Bridge
• Insecure deserialization

PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

• Hyland PACSgear MediaWriter
• Authentication bypass
• Insecure deserialization

PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

• Hyland PACSgear PACS Scan
• Authentication bypass
• Insecure deserialization

Improper deserialization handling in Control-M Components

• BMC Control-M/Enterprise Manager
• BMC Control-M/Server
• Insecure deserialization

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary cod…

• Insecure deserialization

IBM WebSphere eXtreme Scale is affected by Insecure Deserilization

• IBM WebSphere Extreme Scale
• Insecure deserialization

Insecure Deserialization in Redis Cache Backend

• IBM Langflow OSS
• Insecure deserialization

DTMSoft - Deserialization of Untrusted Data Vulnerability

• deltaww DTMSoft
• Insecure deserialization

Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field

• qlstudio Export User Data
• Insecure deserialization

SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket

• Insecure deserialization

>=0.5.5, <=0.5.12 · no fixed version yet

SGLang: Unauthenticated RCE via --enable-custom-logit-processor

• Insecure deserialization

>=0.4.1.post7, <=0.5.12 · no fixed version yet

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

• Insecure deserialization

<=2.2.6 · no fixed version yet

Ludwig framework is vulnerable to insecure deserialization through its predict() method.

• Insecure deserialization

<=0.10.4 · no fixed version yet

Ludwig framework is vulnerable to insecure deserialization in its model serving component

• Insecure deserialization

<=0.10.4 · no fixed version yet

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

• Insecure deserialization

<4.5.115 · fixed in 4.5.115

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

• Insecure deserialization

>=0.0.41, <0.0.94 · fixed in 0.0.94

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

• Insecure deserialization

<0.5.10 · fixed in 0.5.10

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

• Insecure deserialization

<0.5.10 · fixed in 0.5.10

Deserialization of untrusted data in synthcity

• Insecure deserialization

<=0.2.9 · no fixed version yet

Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

• Insecure deserialization

<=1.23.0 · no fixed version yet

Rasa Allows Remote Code Execution via Remote Model Loading

• Code injection
• Insecure deserialization

<3.6.21 · fixed in 3.6.21

pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer

• Insecure deserialization

<=0.3.1 · no fixed version yet

Apache Pyfory python is vulnerable to deserialization of untrusted data

• Insecure deserialization

>=0.1.0, <=0.10.3 · no fixed version yet

Qiskit allows arbitrary code execution decoding QPY format versions < 13

• Insecure deserialization

<1.4.2 || >=2.0.0rc1, <2.0.0rc2 · fixed in 1.4.2, 2.0.0rc2

PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

• Insecure deserialization

<2.6.0 · fixed in 2.6.0

OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

• opf openproject
• Insecure deserialization
• Hard-coded credentials

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

• Insecure deserialization

<2.4.20-Beta1 · fixed in 2.4.20-Beta1

WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability

• Uncanny Owl Uncanny Automator Pro
• Insecure deserialization

WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability

• InspiryThemes RealHomes
• Insecure deserialization

WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

• Buddyboss Platform
• Insecure deserialization

WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability

• Uncanny Owl Uncanny Automator
• Insecure deserialization

ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()

• zaproxy zap-extensions
• Insecure deserialization

Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode

• Insecure deserialization

<0.0.30 · fixed in 0.0.30

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

• Code injection
• Insecure deserialization

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

• Memory corruption
• Denial of service

>=3.0, <3.1.7 · fixed in 3.1.7

amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

• Insecure deserialization

>=1.10.0, <1.117.0 · fixed in 1.117.0

LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

• Insecure deserialization
• CWE-913

<4.1.1 · fixed in 4.1.1

OpenAM has Unsafe Java Deserialization via SNS

• Insecure deserialization

<16.1.1 · fixed in 16.1.1

WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability

• EventPrime
• Insecure deserialization

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability

• MosaicML Composer
• Insecure deserialization

Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto

• Insecure deserialization

<0.63.0 · fixed in 0.63.0

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

• Insecure deserialization

<16.1.1 · fixed in 16.1.1