Insecure deserialization.

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

• modelscope
• Insecure deserialization

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

• Tickera
• Insecure deserialization

Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

• OpenSearch
• Amazon OpenSearch Service
• Insecure deserialization

Unsafe deserialization of decrypted terms enables node DoS in AshCloak

• Insecure deserialization

>=0.1.0, <0.4.0 · fixed in 0.4.0

Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

• User Profile Builder
• Insecure deserialization

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

• Insecure deserialization

<12.3.10 || >=2026.1.0, <2026.1.6 · fixed in 12.3.10, 2026.1.6

Spinnaker: Improper yaml processing on kustomize bake operations

• Insecure deserialization

<2025.3.4 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 || >=2026.1.0, <2026.1.1 · fixed in 2025.3.4, 2025.4.4, 2026.0.3, 2026.1.1

WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability

• Rank Math SEO
• Insecure deserialization

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

• Liquid Web / StellarWP GiveWP
• Insecure deserialization

Deserialization of untrusted data in Tsuyoshi Saito SOY CMS

• Tsuyoshi Saito SOY CMS
• Insecure deserialization

WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

• User Frontend
• Insecure deserialization

Dimension SQL Injection in Scheduled Report

• WatchGuard Dimension
• SQL injection
• Insecure deserialization

Dimension SQL Injection in Audit Report

• WatchGuard Dimension
• SQL injection
• Insecure deserialization

SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing

• speechbrain
• Insecure deserialization

Potential for deserialization of untrusted types in Spring Cloud Stream

• Spring Cloud Stream
• Insecure deserialization

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

• Spring Integration
• Insecure deserialization

Spring for GraphQL Unsafe Deserialization in pagination support

• Spring for GraphQL
• Insecure deserialization

WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

• hashthemes Hash Form
• Insecure deserialization

WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability

• INFINITUM FORM Geo Controller
• Insecure deserialization

WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

• WP Manage Ninja Fluent Boards Pro
• Insecure deserialization

WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

• magepeopleteam Booking and Rental Manager
• Insecure deserialization

Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

• Spring AMQP
• Insecure deserialization

Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

• Spring Batch
• Insecure deserialization

JobParameterDeserializer bypasses the trusted-type allowlist

• Spring Batch
• Insecure deserialization

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

• Spring Integration
• Insecure deserialization

JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

• Spring Integration
• Insecure deserialization

ILIAS PHP Object Injection via Shibboleth Logout

• ILIAS
• Insecure deserialization

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component

• Denial of service
• Insecure deserialization

Duplicate Advisory: Allowlisted pickle loaders still permit code execution in current source

• Insecure deserialization

<=3.10.2 · no fixed version yet

TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

• Insecure deserialization

>=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4 · fixed in 11.6.6, 12.1.4, 13.1.4

Duplicate Advisory: [CWE-502] Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

• Insecure deserialization

<=3.9.4 · no fixed version yet

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimd…

• Insecure deserialization

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

• Nexcess The Events Calendar
• Insecure deserialization

WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

• weDevs WP Project Manager
• Insecure deserialization

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

• A CPT ACPT (Pro) - Custom Post Types Plugin for WordPress
• Insecure deserialization

Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

• Combodo iTop
• Code injection
• Insecure deserialization

Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load

• flair
• Insecure deserialization

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

• Theme-Rex FreightCo
• Insecure deserialization

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization

• ggml-org llama.cpp
• Insecure deserialization
• CWE-20

PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

• buildwps PPWP – Password Protect Pages
• Insecure deserialization

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

• Insecure deserialization

>=3.10.0, <3.10.3 · fixed in 3.10.3

WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

• westguard WS Form LITE – Drag & Drop Contact Form Builder
• Insecure deserialization

Server Side Request Forgery (SSRF) vulnerability reported in Windchill

• PTC Windchill PDMLink
• PTC FlexPLM
• Insecure deserialization
• Server-side request forgery (SSRF)

Critical Remote Code Execution (RCE) vulnerability reported in Windchill

• PTC Windchill PDMLink
• PTC FlexPLM
• Insecure deserialization
• CWE-20

Microsoft Entra ID Remote Code Execution Vulnerability

• Microsoft Entra
• Insecure deserialization

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Hugging Face PyTorch Image Models
• Insecure deserialization

Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

• aeon
• Insecure deserialization

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

• Roxnor FundEngine
• Insecure deserialization

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

• Monkeysan Flatastic
• Insecure deserialization