Insecure deserialization.

MaxSite CMS through 109.6 PHP Object Injection via ci_session

• MaxSite CMS
• Insecure deserialization

Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller

• Red Hat Ceph Storage 5
• Red Hat Ceph Storage 9
• Insecure deserialization

Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

• kstover Ninja Forms – The Contact Form Builder That Grows With You
• Insecure deserialization

tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

• tile-ai tilelang
• Insecure deserialization
• CWE-20

Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

• Insecure deserialization
• CWE-693

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Microsoft Office Publisher Remote Code Execution Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Insecure deserialization

Microsoft SQL Server Remote Code Execution Vulnerability

• Microsoft SQL Server 2019 (CU 32)
• Microsoft SQL Server 2019 (GDR)
• Insecure deserialization

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

• Microsoft Dynamics 365 (on-premises) version 9.1
• Insecure deserialization

Microsoft SQL Server Remote Code Execution Vulnerability

• Microsoft SQL Server 2019 (CU 32)
• Microsoft SQL Server 2019 (GDR)
• Insecure deserialization

Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Insecure deserialization

NLTK: Allowlisted pickle loaders still permit code execution in current source

• Insecure deserialization
• CWE-693

<3.10.3 · fixed in 3.10.3

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

• Insecure deserialization

<3.10.0 · fixed in 3.10.0

Deserialization of untrusted data in Ivanti Neurons for ITSM

• Ivanti Neurons for ITSM
• Insecure deserialization

Deserialization of untrusted data in Ivanti Neurons for ITSM

• Ivanti Neurons for ITSM
• Insecure deserialization

Deserialization of untrusted data in Ivanti Neurons for ITSM

• Ivanti Neurons for ITSM
• Insecure deserialization

Deserialization of untrusted data in Ivanti Neurons for ITSM

• Ivanti Neurons for ITSM
• Insecure deserialization

Deserialization of untrusted data in Ivanti Neurons for ITSM

• Ivanti Neurons for ITSM
• Insecure deserialization

Content Extractor Privilege Escalation

• Commvault Cloud
• Insecure deserialization

Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

• livecomposer Live Composer – Free WordPress Website Builder
• Insecure deserialization

Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

• Hitachi Cosminexus Component Container
• Insecure deserialization

Insecure Deserialization in SAP NetWeaver Business Client

• SAP_SE SAP NetWeaver Business Client
• Insecure deserialization

Code Injection in Next4Biz's CSM (Customer Service Management)

• Next4Biz Information Technologies Inc. CSM (Customer Service Management)
• Insecure deserialization

Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Insecure deserialization

Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

• getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
• Insecure deserialization

Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

• uscnanbu Welcart e-Commerce
• Insecure deserialization

SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

• SolidInvoice
• Insecure deserialization

Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.

• IBM Qiskit SDK
• Insecure deserialization

WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

• eyecix JobSearch
• Insecure deserialization

WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

• WPFunnels Mail Mint
• Insecure deserialization

WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

• rometheme RTMKit
• Insecure deserialization

Unsafe deserialization in the REST interface

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• Command injection
• Insecure deserialization

Deserialization of untrusted data in Jenkins Project Jenkins Performance Plugin

• Jenkins Project Jenkins Performance Plugin
• Insecure deserialization

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization
• CWE-566

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization

Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

• Weaver Show Posts
• Insecure deserialization

WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

• Saturday Drive Ninja Forms - Layout & Styles
• Insecure deserialization

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

• weDevs WP User Frontend
• Insecure deserialization

WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

• User Frontend
• Insecure deserialization

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

• cypht
• Insecure deserialization

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

• Elasticsearch
• Insecure deserialization

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

• Insecure deserialization

>=2.1.0, <3.15.0 · fixed in 3.15.0

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge

• NVIDIA Megatron Bridge
• Insecure deserialization