Insecure deserialization.

WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

• WPMU DEV Forminator
• Insecure deserialization

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

• InternLM lmdeploy
• Insecure deserialization

Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

• Splunk MCP Server app
• Insecure deserialization

Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

• Splunk AI Toolkit
• Insecure deserialization

Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

• wazuh
• Insecure deserialization

Deserialization of untrusted data in Dell Command Update (DCU)

• Dell Command Update (DCU)
• Insecure deserialization

Deserialization of untrusted data in Dell Command Update (DCU)

• Dell Command Update (DCU)
• Insecure deserialization

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

• The4 Kalles Addons
• Insecure deserialization

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

• wpdesk Flexible Subscriptions
• Insecure deserialization

SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

• SPLWare esProc
• Insecure deserialization
• CWE-20

Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology

• Oracle Corporation Oracle Outside In Technology
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology

• Oracle Corporation Oracle Outside In Technology
• Insecure deserialization

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

• Insecure deserialization

<1.6.0 · fixed in 1.6.0

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

• Insecure deserialization

<1.6.0 · fixed in 1.6.0

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

• TaxoPress
• Insecure deserialization

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

• Youzify
• Insecure deserialization

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

• Popup by Supsystic
• Insecure deserialization

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

• Ultimate Maps by Supsystic
• Insecure deserialization

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

• supsystic Easy Google Maps
• Insecure deserialization

WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

• Metagauss RegistrationMagic
• Insecure deserialization

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

• Derek Herman OptionTree
• Insecure deserialization

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

• Roxnor FundEngine
• Insecure deserialization

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

• g5theme Essential Real Estate
• Insecure deserialization

Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service

• Progress ShareFile Storage Zones Controller
• Insecure deserialization

Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

• reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms
• Insecure deserialization

Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection

• wpweaver Turnkey bbPress by WeaverTheme
• Insecure deserialization

Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter

• eteubert Podlove Podcast Publisher
• Insecure deserialization

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

• Code injection
• Insecure deserialization

<0.6.0 · fixed in 0.6.0

AVEVA Enterprise SCADA Deserialization of Untrusted Data

• AVEVA Enterprise SCADA
• AVEVA Enterprise SCADA HMI
• Insecure deserialization

alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

• alldata
• Insecure deserialization
• CWE-20

IBM WebSphere Application Server Liberty is affected by a denial of service

• IBM WebSphere Application Server - Liberty
• Insecure deserialization

Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

• Apache Software Foundation Apache Shindig Common
• Apache Software Foundation Apache Shindig Social-Api
• Insecure deserialization

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

• Booking Activities
• Insecure deserialization

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

• miniOrange Headless Single Sign On
• Insecure deserialization

WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

• magepeopleteam Car Rental Manager
• Insecure deserialization

Filter expression injection via forged keyset pagination cursor in Ash

• SQL injection
• Insecure deserialization

>=1.17.0, <3.31.3 · fixed in 3.31.3

Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itsel...

• Insecure deserialization

>=3.3.0, <3.3.1 · fixed in 3.3.1

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without ...

• Insecure deserialization

>=3.3.0, <3.3.1 · fixed in 3.3.1

Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` g...

• Insecure deserialization

<3.3.1 · fixed in 3.3.1

Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob...

• Insecure deserialization

>=3.3.0, <3.3.1 · fixed in 3.3.1

Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization

• Fujitsu Research OneCompression
• Insecure deserialization

Potential insecure deserialization in JFrog Artifactory

• jfrog artifactory
• Insecure deserialization

Deserialization of untrusted data in SonicWall GMS

• SonicWall GMS
• Insecure deserialization

Lightroom Classic | Deserialization of Untrusted Data (CWE-502)

• Adobe Lightroom Classic
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Server Subscription Edition
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Remote Code Execution Vulnerability

• Microsoft SharePoint Server Subscription Edition
• Insecure deserialization

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

• Microsoft Dynamics 365 (on-premises) version 9.1
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft Exchange Server Denial of Service Vulnerability

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 14
• Insecure deserialization

Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

• Microsoft HPC Pack 2019
• Insecure deserialization

Microsoft SharePoint Server Spoofing Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Microsoft SharePoint Server Remote Code Execution Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Insecure deserialization

Deserialization of untrusted data in Intel(R) Extension for PyTorch

• Intel(R) Extension for PyTorch
• Insecure deserialization

Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026

• Dassault Systèmes SIMULIA Execution Engine
• Insecure deserialization

Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

• Red Hat JBoss Enterprise Application Platform 7.4.25
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
• Insecure deserialization

Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs

• Insecure deserialization

<0.67.0 · fixed in 0.67.0