Insecure deserialization.

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

• Insecure deserialization

>=2.0.0, <2.25.1 · fixed in 2.25.1

In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.

• Insecure deserialization

manga-image-translator Shared API Unsafe Deserialization RCE

• zyddnys manga-image-translator
• Insecure deserialization

DiskCache has unsafe pickle deserialization

• Code injection
• Insecure deserialization

<=5.6.3 · no fixed version yet

wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection

• tomdever wpForo Forum
• Insecure deserialization

WP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection

• WP eCommerce
• Insecure deserialization

Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

• Insecure deserialization

<1.0.0b4 · fixed in 1.0.0b4

Microsoft Outlook Spoofing Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Insecure deserialization

Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)

• SAP_SE SAP NetWeaver (JMS service)
• Insecure deserialization

PowerDocu Affected by Remote Code Execution via Insecure Deserialization

• modery PowerDocu
• Insecure deserialization

Phar Deserialization leading to Arbitrary File Deletion in my little forum

• My-Little-Forum mylittleforum
• Unrestricted file upload
• Insecure deserialization

yuan1994 tpadmin WebUploader preview.php deserialization

• yuan1994 tpadmin
• Insecure deserialization
• CWE-20

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

• Insecure deserialization

<0.16.1 · fixed in 0.16.1

CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

• CraftCMS
• Insecure deserialization

Deserialization of untrusted data in Blesta

• Blesta
• Insecure deserialization

Deserialization of untrusted data in Blesta

• Blesta
• Insecure deserialization

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

• Insecure deserialization

<=2.0.0 · no fixed version yet

Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

• Insecure deserialization

<20251230 · fixed in 20251230

WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability

• magepeopleteam WpEvently
• Insecure deserialization

picklescan vulnerable to arbitrary file create using logging.FileHandler

• Insecure deserialization

<1.0.1 · fixed in 1.0.1

picklescan missing detection by simple obfuscation of a `builtins.eval` call

• Insecure deserialization

<1.0.1 · fixed in 1.0.1

bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization

• bolo-solo
• Insecure deserialization
• CWE-20

React Server Components have multiple Denial of Service Vulnerabilities

• Denial of service
• Insecure deserialization

>=19.0.0, <19.0.4 || >=19.1.0-canary-7130d0c6-20241212, <19.1.5 || >=19.2.0-canary-63779030-20250328, <19.2.4 · fixed in 19.0.4, 19.1.5, 19.2.4

JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

• Insecure deserialization
• Prototype pollution

<1.2.0 · fixed in 1.2.0

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

• Denial of service
• Insecure deserialization

>=13.0.0, <15.0.8 || >=15.1.1-canary.0, <15.1.12 || >=15.2.0-canary.0, <15.2.9 || >=15.3.0-canary.0, <15.3.9 || >=15.4.0-canary.0, <15.4.11 || >=15.5.1-canary.0, <15.5.10 || >=15.6.0-canary.0, <15.6.0-canary.61 || >=16.0.0-beta.0, <16.0.11 || >=16.1.0-canary.0, <16.1.5 · fixed in 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

• SolarWinds Web Help Desk
• Insecure deserialization

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

• SolarWinds Web Help Desk
• Insecure deserialization

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

• Insecure deserialization

<8.5.52 || >=9.0.0, <9.6.33 || >=10.0.0, <10.5.62 || >=11.0.0, <11.5.50 || >=12.0.0, <12.5.8 · fixed in 8.5.52, 9.6.33, 10.5.62, 11.5.50, 12.5.8

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files

• Code injection
• Insecure deserialization

<2.10.0 · fixed in 2.10.0

A XStream Security Vulnerability in XML Deserialization in datavane/tis

• datavane tis
• Unrestricted file upload
• Insecure deserialization

Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector

• Insecure deserialization

<2.12.0 · fixed in 2.12.0

Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Anritsu VectorStar
• Insecure deserialization

Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Anritsu VectorStar
• Insecure deserialization

Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Anritsu ShockLine
• Insecure deserialization

Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Upsonic
• Insecure deserialization

Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Langflow
• Insecure deserialization

GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability

• GPT Academic
• Insecure deserialization

GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability

• GPT Academic
• Insecure deserialization

GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability

• GPT Academic
• Insecure deserialization

Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Foundation Agents MetaGPT
• Insecure deserialization

docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage

• Insecure deserialization

>=2.21.0, <2.48.4 · fixed in 2.48.4

WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability

• fuelthemes North
• Insecure deserialization

WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability

• ThemeREX Sound | Musical Instruments Online Store
• Insecure deserialization

WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability

• strongholdthemes Tech Life CPT
• Insecure deserialization

WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability

• Strongholdthemes Dental Care CPT
• Insecure deserialization

WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

• designthemes OneLife
• Insecure deserialization

WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability

• AivahThemes Anona
• Insecure deserialization

WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

• designthemes Vivagh
• Insecure deserialization

WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

• Arraytics Eventin
• Insecure deserialization

WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability

• designthemes Kids Heaven
• Insecure deserialization

WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability

• themeton Consult Aid
• Insecure deserialization

WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability

• artbees JupiterX Core
• Insecure deserialization

Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization

• Code injection
• Insecure deserialization

<15.3.12 · fixed in 15.3.12

mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

• Insecure deserialization

<0.4.3 || >=0.5.0, <0.5.1 · fixed in 0.4.3, 0.5.1

seroval Affected by Remote Code Execution via JSON Deserialization

• Insecure deserialization

<1.4.1 · fixed in 1.4.1

Laravel Redis Horizontal Scaling Insecure Deserialization

• Insecure deserialization

<1.7.0 · fixed in 1.7.0

Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'

• posimyththemes Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
• Insecure deserialization

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function.

• Insecure deserialization

Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE

• Changjetong Information Technology Co., Ltd. T+
• Insecure deserialization

Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE

• Entrust Corporation Instant Financial Issuance (IF)
• Authentication bypass
• Insecure deserialization