Insecure deserialization.

Sentry: Unsafe pickle deserialization in Relocation Feature

• sentry
• Insecure deserialization

MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

• MISP
• Other injection
• Insecure deserialization

CVE-2026-93088

• SGLang
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Speech

• NVIDIA NeMo Speech
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Speech

• NVIDIA NeMo Speech
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Speech

• NVIDIA NeMo Speech
• Insecure deserialization

Deserialization of untrusted data in NVIDIA NeMo Speech

• NVIDIA NeMo Speech
• Insecure deserialization

Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

• Ninja Forms
• Insecure deserialization

Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

• LiquidWeb Give Tributes
• Insecure deserialization

Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

• Apache Software Foundation Apache MINA
• Insecure deserialization

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __r…

• Insecure deserialization

DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization

• DLR-RM stable-baselines3
• Insecure deserialization
• CWE-20

dmlc dgl utils.py _read_torch_data deserialization

• dmlc dgl
• Insecure deserialization
• CWE-20

piskvorky gensim Model Loader utils.py load deserialization

• piskvorky gensim
• Insecure deserialization
• CWE-20

Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

• Unlimited Elements For Elementor
• Insecure deserialization

Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

• Cotonti
• Insecure deserialization

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Insecure deserialization

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• Insecure deserialization

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

• Insecure deserialization

>=0.9.2, <0.16.0 · fixed in 0.16.0

IBM MQ Java messaging is vulnerable to remote code execution

• IBM MQ
• Insecure deserialization

ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
• Insecure deserialization

HGiga｜OAKlouds - Insecure Deserialization

• HGiga OAKlouds-custom_page-2.0
• HGiga OAKlouds-custom_page-3.0
• Insecure deserialization

NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request

• netbox-community devicetype-library
• Insecure deserialization
• CWE-829

b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key

• b2evolution CMS
• Insecure deserialization

Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`

• kedro-org kedro-plugins
• Insecure deserialization

Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

• angel
• Insecure deserialization

Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Insecure deserialization

Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Insecure deserialization

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• Insecure deserialization

Cisco Identity Services Engine Remote Code Execution Vulnerability

• Cisco Identity Services Engine Software
• Insecure deserialization

Cisco Identity Services Engine Remote Code Execution Vulnerability

• Cisco Identity Services Engine Software
• Insecure deserialization

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

• Insecure deserialization

>=0.9.1, <0.10.2 · fixed in 0.10.2

Deserialization of untrusted data in Dell ObjectScale

• Dell ObjectScale
• Insecure deserialization

Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

• Cotonti
• Insecure deserialization

IBM MQ Java messaging is vulnerable to remote code execution

• IBM MQ
• Insecure deserialization

IBM MQ Java messaging is vulnerable to remote code execution

• IBM MQ
• Insecure deserialization

Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet

• Yonyou U8 Cloud
• Insecure deserialization

OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization

• OpenBankProject OBP-API
• Insecure deserialization
• CWE-20

IBM MQ Java messaging is vulnerable to remote code execution

• IBM MQ
• Insecure deserialization

Deserialization of untrusted data in WebPros WHMCS

• WebPros WHMCS
• Insecure deserialization

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

• IBM App Connect Enterprise
• Insecure deserialization

IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

• IBM App Connect Enterprise
• Insecure deserialization

October CMS: PHP Object Injection via Backend Widget Session Storage

• Insecure deserialization

<3.7.17 || >=4.0.0, <4.2.23 · fixed in 3.7.17, 4.2.23

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

• ModelTC LightLLM
• Insecure deserialization

FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

• FedML
• Insecure deserialization
• CWE-20

PHPGurukul Small CRM Login Success login.php unserialize deserialization

• PHPGurukul Small CRM
• Insecure deserialization
• CWE-20

ESPnet before 202609 Remote Code Execution via Unsafe Deserialization

• espnet
• Insecure deserialization

lenve vhr MailReceiver deserialization

• lenve vhr
• Insecure deserialization
• CWE-20

Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

• themeum Tutor LMS – eLearning and online course solution
• Insecure deserialization

The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

• stellarwp The Events Calendar
• Insecure deserialization

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

• wpstorecart
• Insecure deserialization

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

• Masteriyo LMS
• Insecure deserialization

Deserialization of Untrusted Data in GitLab

• GitLab
• Insecure deserialization

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

• Masteriyo - LMS
• Insecure deserialization

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

• ThemeREX Addons
• Insecure deserialization

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

• wpeverest Everest Forms
• Insecure deserialization

FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

• FileRun
• Insecure deserialization

WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability

• Marcin Wise Chat
• Insecure deserialization

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

• Site Reviews
• Insecure deserialization

Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Insecure deserialization