Insecure deserialization.

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

• Insecure deserialization

>=16.0.0, <16.4.1 · fixed in 16.4.1

Insecure Deserialization of .cleanshot Files in CleanShot X

• MTW CleanShot X
• Insecure deserialization

Deserialization of untrusted data in Roundcube Webmail

• Roundcube Webmail
• Insecure deserialization

TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

• TastyIgniter
• Insecure deserialization

pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

• pfrest pfSense-pkg-RESTAPI
• Insecure deserialization

PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

• PHPOffice PHPPresentation
• Insecure deserialization

WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability

• WordPress Team Members – GS Plugins
• Insecure deserialization

WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability

• GS Plugins GS Pins for Pinterest
• Insecure deserialization

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

• smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
• Duplicator Pro
• Insecure deserialization

Deserialization of untrusted data in floss

• Mandiant FLARE floss
• Insecure deserialization

Deserialization of untrusted data in capa

• Mandiant FLARE capa
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology

• Oracle Corporation Oracle Outside In Technology
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology

• Oracle Corporation Oracle Outside In Technology
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology

• Oracle Corporation Oracle Outside In Technology
• Insecure deserialization

Deserialization of untrusted data in Oracle Corporation Oracle Java SE

• Oracle Corporation Oracle Java SE
• Insecure deserialization

Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

• Apache Software Foundation Apache CouchDB
• Insecure deserialization

DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition

• DokuWiki
• Insecure deserialization

Uniong｜WebITR - Insecure Deserialization

• Uniong WebITR
• Insecure deserialization

IBM MQ Deserialization of Untrusted Data

• IBM MQ Operator
• IBM MQ Advanced container images
• Insecure deserialization

IBM MQ Deserialization of Untrusted Data

• IBM MQ Operator
• IBM MQ Advanced container images
• Insecure deserialization

IBM MQ Deserialization of Untrusted Data

• IBM MQ Operator
• IBM MQ Advanced container images
• Insecure deserialization

docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()

• Mindee docTR
• Insecure deserialization

Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution

• Apache Software Foundation Apache Camel
• Insecure deserialization

Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads

• Apache Software Foundation Apache Camel
• Insecure deserialization

Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

• Apache Software Foundation Apache Camel
• Insecure deserialization

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

• ExpressTech Quiz And Survey Master
• Insecure deserialization

ESPnet Inference Model inference_model.py build_model deserialization

• ESPnet
• Insecure deserialization
• CWE-20

hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization

• hankcs HanLP
• Insecure deserialization
• CWE-20

hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

• hankcs HanLP
• Insecure deserialization
• CWE-20

WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

• WP Chill Strong Testimonials
• Insecure deserialization

WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

• QuantumCloud Conversational Forms for ChatBot
• Insecure deserialization

datastax pulsar-jms PulsarObjectMessage.java decode deserialization

• datastax pulsar-jms
• Insecure deserialization
• CWE-20

Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

• ACF Frontend Admin by DynamiApps
• Insecure deserialization

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Insecure deserialization

Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import

• themeum Kirki – Freeform Page Builder, Website Builder & Customizer
• Insecure deserialization

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass
• Insecure deserialization

>=0.3.9, <0.5.6 · fixed in 0.5.6

10up Distributor before 2.3.2 PHP Object Injection via set_meta()

• 10up Distributor
• Insecure deserialization

Apache Kylin: Redis unsafe Java deserialization

• Apache Software Foundation Apache Kylin
• Insecure deserialization

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

• Rocketgenius, Inc Gravity Forms
• Insecure deserialization

Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

• sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
• Insecure deserialization

Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

• johnny5 Search Regex
• Insecure deserialization

Deserialization of untrusted data in Lenovo Legion Zone Application

• Lenovo Legion Zone Application
• Insecure deserialization

LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization

• ModelTC LightLLM
• Insecure deserialization

Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

• dolibarr
• Insecure deserialization

runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

• containerd runwasi
• Insecure deserialization

Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

• AWS Amazon Neptune Engine
• Insecure deserialization
• Server-side request forgery (SSRF)

Deserialization of untrusted data in JetBrains TeamCity

• JetBrains TeamCity
• Insecure deserialization

EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

• espocrm
• Insecure deserialization

WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

• Link Whisper INC Link Whisper Free
• Insecure deserialization

Deserialization of untrusted data in Eclipse Foundation Eclipse Vert.x

• Eclipse Foundation Eclipse Vert.x
• Insecure deserialization

ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

• ILIAS
• Insecure deserialization

e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

• e107
• Insecure deserialization

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

• itthinx Affiliates
• Insecure deserialization

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

• Brainstorm Force SureCart
• Insecure deserialization

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

• WP SYNTEX Polylang
• Insecure deserialization

HPE NonStop Middleware - Secret key handling vulnerability

• Hewlett Packard Enterprise HPE NonStop Middleware
• Insecure deserialization

Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

• wpazleen Post Export Import with Media
• Insecure deserialization

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

• Insecure deserialization

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

• Insecure deserialization

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

• Insecure deserialization

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2