Insecure deserialization.

Kiteworks Email Protection Gateway deserialization of untrusted data

• Kiteworks Email Protection Gateway
• Insecure deserialization

Kiteworks Email Protection Gateway Deserialization of Untrusted Data

• Kiteworks Email Protection Gateway
• Insecure deserialization

Kiteworks Core deserialization of untrusted data

• Kiteworks Core
• Insecure deserialization

WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

• ThemeHigh Extra Product Options For WooCommerce | Custom Product Addons and Fields
• Insecure deserialization

WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability

• Photo Gallery by 10Web
• Insecure deserialization

WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability

• Hook & Filter Nested Pages
• Insecure deserialization

WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

• Magazine3 Schema & Structured Data for WP & AMP
• Insecure deserialization

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

• Greg – SiteOrigin Page Builder by SiteOrigin
• Insecure deserialization

Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

• The Wikimedia Foundation MediaWiki Wikibase extension
• Insecure deserialization

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

• ModelTC LightLLM
• Insecure deserialization

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

• Booking Activities
• Insecure deserialization

WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

• ShortPixel Image Optimizer
• Insecure deserialization

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

• Themefic Ultimate Addons for Contact Form 7
• Insecure deserialization

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

• keywordrush Content Egg
• Insecure deserialization

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

• themifyme Themify Builder
• Insecure deserialization

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

• impleCode eCommerce Product Catalog
• Insecure deserialization

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

• weDevs WP ERP
• Insecure deserialization

WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability

• QuantumCloud Conversational Forms for ChatBot
• Insecure deserialization

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

• Justin Nealey DesignSetGo
• Insecure deserialization

WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability

• Mat Lipe Go Live Update Urls
• Insecure deserialization

WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability

• Nexcess Kadence WooCommerce Email Designer
• Insecure deserialization

WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability

• A WP Life Responsive Slider Gallery
• Insecure deserialization

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability

• 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
• Insecure deserialization

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

• SEO Squirrly SEO Plugin by Squirrly SEO
• Insecure deserialization

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

• WPFactory Cost of Goods for WooCommerce
• Insecure deserialization

WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

• Dotstore Minimum and Maximum Quantity for WooCommerce
• Insecure deserialization

WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability

• codepeople Music Player for WooCommerce
• Insecure deserialization

DigiWin｜EasyFlow .NET - Insecure Deserialization

• DigiWin EasyFlow .NET
• Insecure deserialization

EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

• EWWW Image Optimizer
• Insecure deserialization

Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution

• WatchGuard Fireware OS
• Insecure deserialization

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

• ModelTC LightLLM
• Insecure deserialization

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

• ModelTC LightLLM
• Insecure deserialization

GluonTS arbitrary command execution during model deserialization

• AWS gluonts
• Code injection
• Insecure deserialization

Deserialization of untrusted data in Octopus Deploy Octopus Server

• Octopus Deploy Octopus Server
• Insecure deserialization

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

• Insecure deserialization
• Broken access control

>=2.11.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2 · fixed in 2.18.10, 2.21.6, 2.22.2

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

• Google Cloud Application Integration
• Insecure deserialization

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

• Apache Software Foundation Apache Roller
• Insecure deserialization

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

• Online Scheduling and Appointment Booking System
• Insecure deserialization

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in ...

• Insecure deserialization

· no fixed version yet

langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

• langchain4j
• Insecure deserialization
• CWE-20

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Insecure deserialization

Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization

• Open-Web-Analytics
• Insecure deserialization
• CWE-20

yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

• Insecure deserialization

<1.19.0 · fixed in 1.19.0

PHP object injection via unsuppressible __pclass class inference in command monitoring events

• MongoDB PHP Driver
• Insecure deserialization

BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests

• alam00000 bentopdf
• Information disclosure
• Insecure deserialization

DataStage on Cloud Pak for Data has several vulnerabilities

• IBM DataStage on Cloud Pak for Data
• Insecure deserialization

wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

• wpForo Forum
• Insecure deserialization

WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

• Victor Rodriguez Reycob Product Import Export
• Insecure deserialization

CVE-2026-96804

• MLflow
• Insecure deserialization

MLflow dspy bypasses pickle deserialization control

• MLflow
• Insecure deserialization

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Insecure deserialization

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel

• ModelTC LightLLM
• Insecure deserialization

recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization

• recommenders
• Insecure deserialization
• CWE-20

Dask Loader core.py from_npy_stack deserialization

• Dask
• Insecure deserialization
• CWE-20

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Insecure deserialization

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Insecure deserialization

openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

• Apereo Foundation openEQUELLA
• Insecure deserialization
• CWE-184

SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

• SolarWinds Observability Self-Hosted
• Insecure deserialization

Softaculous Virtualizor PHP Object Injection via Billing Module Handler

• Softaculous Virtualizor
• Insecure deserialization

Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

• netdata
• Path traversal
• Insecure deserialization