Insecure deserialization.

Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

• Insecure deserialization

>=1.17.0, <3.31.1 · fixed in 3.31.1

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

• Newsletters
• Insecure deserialization

ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer

• ZenML
• Insecure deserialization

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

• Apache Software Foundation Apache Fory
• Insecure deserialization

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

• Apache Software Foundation Apache Fory
• Insecure deserialization

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

• Apache Software Foundation Apache Fory
• Insecure deserialization

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

• Ajax Search Lite
• Insecure deserialization

Azure Service Bus Remote Code Execution Vulnerability

• Microsoft Azure Service Bus
• Insecure deserialization

WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability

• Axiomthemes AI ANN
• Insecure deserialization

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

• axiomthemes Agricola
• Insecure deserialization

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

• AncoraThemes Agora
• Insecure deserialization

WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability

• AncoraThemes Advice
• Insecure deserialization

WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability

• AncoraThemes Adrena
• Insecure deserialization

WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability

• AncoraThemes Accalia
• Insecure deserialization

WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability

• AncoraThemes Abogado
• Insecure deserialization

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

• ThemeREX Abelle
• Insecure deserialization

WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability

• Axiomthemes A.Williams
• Insecure deserialization

WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability

• Axiomthemes 69 Clothing
• Insecure deserialization

WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability

• MihChe WPBruiser {no- Captcha anti-Spam}
• Insecure deserialization

WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

• qstudio Export User Data
• Insecure deserialization

WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

• jegtheme Jeg Kit for Elementor
• Insecure deserialization

WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

• wpdreams Ajax Search Lite
• Insecure deserialization

Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

• Apache Software Foundation Apache CXF
• Insecure deserialization

Deserialization of untrusted data in Jenkins and others

• Jenkins
• Jenkins Project Remoting
• Insecure deserialization

Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

• Cotonti
• Insecure deserialization

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

• huggingface peft
• Insecure deserialization

Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS

• Apache Software Foundation Apache Lucy
• Insecure deserialization

MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

• MaxSite CMS
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Dynamo

• NVIDIA Dynamo
• Insecure deserialization

kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

• Cinnamon kotaemon
• Insecure deserialization

Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

• TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock
• Insecure deserialization

Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import

• Clearfy Cache
• Insecure deserialization

Chama < 1.0.13 - Unauthenticated PHP Object Injection

• ChamaWP
• Insecure deserialization

Deserialization of untrusted data in Canon Production Printing PRISMAproduction

• Canon Production Printing PRISMAproduction
• Insecure deserialization

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

• Event Booking Manager for WooCommerce
• Insecure deserialization

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

• Comfy-Org ComfyUI
• Insecure deserialization

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

• Kirki
• Insecure deserialization

IBM WebSphere Application Server is affected by a remote code execution vulnerability

• IBM WebSphere Application Server
• Insecure deserialization

CVE-2026-15969

• SGLang
• Insecure deserialization

CVE-2026-15976

• SGLang
• Insecure deserialization

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

• IBM webMethods Integration (on prem)
• Insecure deserialization

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

• e107
• Insecure deserialization

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

• BuddyPress
• Insecure deserialization

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

• aimy-extensions.com Aimy Captcha-Less Form Guard plugin for Joomla
• Insecure deserialization

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

• Apache Software Foundation Apache Traffic Server
• Insecure deserialization

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

• IBM WebSphere Application Server
• Insecure deserialization

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

• IBM WebSphere Application Server
• Insecure deserialization

Apache Axis2/Java: deserialization of untrusted Data

• Apache Software Foundation Apache Axis2/Java
• Insecure deserialization

Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

• Dassault Systèmes Station Launcher App in 3DEXPERIENCE platform
• Insecure deserialization

Potential remote code execution on an Artifactory package service container.

• jfrog artifactory
• Insecure deserialization

Deserialization of untrusted data in JetBrains TeamCity

• JetBrains TeamCity
• Insecure deserialization

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

• techjewel Fluent Forms Pro Add On Pack
• Insecure deserialization

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

• Insecure deserialization

<16.1.2 · fixed in 16.1.2

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

• Insecure deserialization
• Memory corruption

<1.5.3 · fixed in 1.5.3

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

• Code injection
• Insecure deserialization

<2.56.0 · fixed in 2.56.0

Microsoft M365 Copilot Remote Code Execution Vulnerability

• Microsoft 365 Copilot
• Insecure deserialization

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

• Johnson Control victor
• Johnson Controls CCure 9000
• Insecure deserialization

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

• Insecure deserialization
• Broken access control

<0.14.0 · fixed in 0.14.0

WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability

• Complianz
• Insecure deserialization

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

• Dokan Pro
• Insecure deserialization