Insecure deserialization.

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

• Thrive Themes Coupon Thrive Quiz Builder
• Insecure deserialization

fastjson has a remote code execution (RCE) vulnerability

• Insecure deserialization
• CWE-20

>=1.2.68, <=1.2.83 · no fixed version yet

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Authentication bypass

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Authentication bypass

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Authentication bypass

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Broken access control

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Broken access control

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Authentication bypass

Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java

• Oracle Corporation Oracle Platform Security for Java
• Privilege escalation
• Broken access control

PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Insecure deserialization

PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

• Progress Software Telerik UI for ASP.NET AJAX
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Java SE

• Oracle Corporation Oracle Java SE
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Tranformers4Rec

• NVIDIA Tranformers4Rec
• Insecure deserialization

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

• Apache Software Foundation Apache Fory
• Insecure deserialization

Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

• Apache Software Foundation Apache Fory
• Insecure deserialization
• Memory corruption

ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ

• kvcache-ai ktransformers
• Insecure deserialization

Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

• wazuh
• Insecure deserialization

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

• Insecure deserialization

<3.12.3 || >=3.13.0, <3.15.0 · fixed in 3.12.3, 3.15.0

Disk Cache Deserialization Remote Code Execution Vulnerability

• IBM Langflow OSS
• Insecure deserialization

CVE-2026-14890

• SGLang
• Insecure deserialization

Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

• uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT

• NVIDIA TensorRT
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

Deserialization of untrusted data in NVIDIA TensorRT-LLM

• NVIDIA TensorRT-LLM
• Insecure deserialization

.NET Remote Code Execution Vulnerability

• Microsoft .NET 8.0 runtime
• Microsoft .NET 9.0 runtime
• Insecure deserialization

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

• Microsoft Dynamics NAV 2018
• Insecure deserialization

Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Insecure deserialization

Azure Active Directory Denial of Service Vulnerability

• Microsoft Azure Active Directory
• Microsoft .NET Framework 3.5
• Insecure deserialization

Microsoft SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SQL Server Remote Code Execution Vulnerability

• Microsoft SQL Server 2016 Service Pack 3 (GDR)
• Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
• Insecure deserialization

Microsoft SQL Server Remote Code Execution Vulnerability

• Microsoft SQL Server 2025 (CU 6)
• Microsoft SQL Server 2025 for x64-based Systems (GDR)
• Insecure deserialization

Microsoft Exchange Server Elevation of Privilege Vulnerability

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 14
• Insecure deserialization

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

• Newsletters
• Insecure deserialization

Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)

• SAP_SE SAP Change and Transport System Attach Tool (ctsattach)
• Insecure deserialization

WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability

• ShapedPlugin LLC Real Testimonials
• Insecure deserialization

WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

• wpWax Directorist
• Insecure deserialization

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

• ThemeGoods Grand Photography
• Insecure deserialization

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability

• stmcan RT-Theme 18 | Extensions
• Insecure deserialization

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

• axiomthemes 777
• Insecure deserialization

WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

• Themeum Kirki
• Insecure deserialization

WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

• Marcus (aka @msykes) Events Manager
• Insecure deserialization

WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability

• denishua WPJAM Basic
• Insecure deserialization

PyOD persistence.load deserializes untrusted artifacts before validation

• Insecure deserialization
• CWE-20

>=3.5.0, <3.6.2 · fixed in 3.6.2

AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization

• AkariAsai self-rag
• Insecure deserialization
• CWE-20

yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization

• yashbhalgat HashNeRF-pytorch
• Insecure deserialization
• CWE-20

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

• Microsoft Edge (Chromium-based)
• Insecure deserialization

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

• Insecure deserialization

<0.6.3 · fixed in 0.6.3

Deserialization of untrusted data in Dell Unisphere for PowerMax

• Dell Unisphere for PowerMax
• Insecure deserialization

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

• Cross-site request forgery (CSRF)
• Insecure deserialization

<4.6.6 · fixed in 4.6.6

Metabase: Unsafe Deserialization of H2 Query Results

• metabase
• Insecure deserialization

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embe...

• Insecure deserialization

<3.3.0 · fixed in 3.3.0

Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel

• Apache Software Foundation Apache OpenNLP :: Core :: ML :: LibSVM
• Insecure deserialization

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

• Insecure deserialization

>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

• Insecure deserialization

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel JMS deserialization filter bypass

• Insecure deserialization

>=3.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

• Insecure deserialization

>=4.14.0, <4.14.8 || >=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

• Insecure deserialization

>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

• Insecure deserialization

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.20.0 · fixed in 4.14.8, 4.18.3, 4.20.0