Insecure Deserialization

Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.

Code execution, data tampering, denial of service, and information disclosure are all reachable in NVIDIA NeMo Speech 0.0 through 2.9 because its TabularTokenizer class deserializes attacker-supplied .pkl artifacts through pickle.load() with no validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) marks this as unauthenticated but user-interaction-gated: nothing executes until a NeMo user obtains and loads the malicious tokenizer or model file, so the attack depends on a social-engineering or supply-chain delivery step rather than a directly triggerable remote request. Impact is rated high across all three security properties, but no public exploit code was identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status; realistic exposure is further narrowed by the research and development orientation of the affected toolkit.

Code execution, data tampering, denial of service, and information disclosure in NVIDIA NeMo Speech (versions 0.0 through 2.9) stem from unsafe deserialization of parameters injected through a maliciously crafted model_config.yaml handled by the dataset-loading workflow. The issue is locally scoped: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:R with a base score of 7.8, meaning an attacker with low privileges must place the crafted config where the victim or an automated pipeline will parse it - for example inside a shared or downloaded model bundle or dataset - and exploitation depends on that untrusted NeMo config being loaded. There is no remote network-service exposure, and no public exploit identified at time of analysis; the CVE is not listed in CISA KEV.

Code execution, information disclosure, and data tampering are possible in NVIDIA NeMo Speech versions 0.0 through 2.9 due to unsafe deserialization of untrusted data. Exploitation requires the victim to load attacker-crafted serialized data (dataset, manifest, or model checkpoint) on their own machine, making this a local, user-interaction-dependent flaw (AV:L/UI:R) that runs with the victim's privileges. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Deserialization of untrusted data in the NVIDIA NeMo Speech 'Speech Data Explorer' component (affected versions 0.0 through 2.9, all platforms) lets an attacker who supplies crafted malicious data achieve code execution in the context of the user running the tool, with follow-on privilege escalation, information disclosure, and data tampering. The flaw requires no authentication on the target (PR:N) but is local in reach (AV:L) and depends on user interaction (UI:R) - a user must actively open or load the attacker-crafted dataset, manifest, or serialized artifact inside the Explorer, which confines exposure to developers and researchers running NeMo rather than production network services. No public exploit code was identified at time of analysis, there is no confirmed active exploitation (the CVE is not in CISA KEV), and the CVSS 3.1 base score is 7.8 (CWE-502).

PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized payloads in user-submitted form field values that are later deserialized when an administrator exports submissions to CSV. Publicly available exploit code exists, but full impact - arbitrary file operations or remote code execution - is conditional on a suitable POP gadget chain being present in another installed plugin or theme; without such a chain, the object injection has limited practical impact. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (7.5) reflects the admin-initiated export action and POP-chain prerequisites rather than guaranteed code execution.

Unauthenticated PHP object injection in the Give Tributes WordPress plugin, affecting all versions up to and including 2.3.1, allows an attacker to place a crafted serialized object into donation data that the plugin later deserializes. The flaw is not exploitable in isolation: Give Tributes ships no POP/gadget chain, so it only produces impact when a separate plugin or theme on the same site supplies one, and even then the attacker must reach a form where 'Allow Multiple Recipients' is enabled (the single-recipient path runs sanitize_textarea_field() and neutralizes the payload) while the eCard 'Custom Message' option is disabled, the plugin default. Our independent assessment keeps this at PR:N/UI:N but raises attack complexity to High for the required non-default configuration plus third-party gadget dependency, rather than the nominal CVSS 9.8/AC:L rating; no public exploit code has been identified at time of analysis.

Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).

Path traversal in Joplin's sync resource handling lets an attacker who can write to a synchronized target (a shared notebook or a compromised/shared sync backend) plant a resource item with a malformed id or file_extension, causing the client to write the attacker-controlled blob outside the resource directory at an attacker-chosen existing path. Affected clients are Joplin versions before 3.6.15 and 3.7.2; exploitation occurs during routine background synchronization, with no user interaction, and integrity impact is high while confidentiality and availability impacts are low. This is a genuine but conditionally-gated integrity issue rather than a mass-exploitation priority: the attacker must already be inside the sync trust boundary (as a shared-notebook collaborator or with credentials to the sync store), and there is no public exploit identified at time of analysis.

Unauthenticated remote code execution risk in Apache MINA 2.0.X through 2.0.30 and 2.1.X through 2.1.14 arises because those maintenance branches never received the resolveProxyClass() override that closed CVE-2026-47065. An attacker who can reach an application that uses MINA's ObjectSerializationDecoder and relies on acceptMatchers can wrap a malicious serialized object in java.lang.reflect.Proxy to bypass the allow-list, and, if a suitable gadget chain is present, execute code. No public exploit identified at time of analysis; upgrades within 2.0.X or 2.1.X do not remediate, so affected users must move to the 2.2.X line at 2.2.8 or later.

PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.

PHP object injection in Cotonti 1.0.0 allows authenticated users with comment-write permissions to pass attacker-controlled base64-encoded data through the cb (comeback) parameter of the comments plugin EditAction, which is then unserialized without an allowed_classes restriction. This can lead to arbitrary PHP object instantiation and, only if a viable POP gadget chain exists among loaded classes, escalation to file write or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; the vendor has published a fix in PR #1897, and the vendor CVSS 4.0 score is 7.7, while the independent CVSS 3.1 assessment is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Unauthenticated insecure deserialization in the Change Audit System (CAS) listener of IBM Guardium Data Protection 12.2 allows a network attacker who can reach TCP port 16017 to submit crafted serialized messages that are insecurely deserialized and used for attacker-controlled reflective method dispatch, potentially resulting in unintended code execution on the Guardium appliance with high confidentiality, integrity, and availability impact. The vendor-reported base score is 9.8 (AV:N/AC:L/PR:N/UI:N); our independent assessment keeps the unauthenticated, no-user-interaction profile but applies AC:H, because the practical gating factor is whether an attacker has a network path to the non-standard CAS port rather than any product configuration toggle. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); IBM has published a vendor patch advisory, and this should be treated as a genuinely high-priority issue for any deployment where port 16017 is reachable from untrusted networks, while remaining lower-risk in segmented or hardened environments where the listener is internal-only.

Unauthenticated remote code execution in IBM Guardium Data Protection 12.2 lets a network attacker who can reach the appliance interface that processes serialized input run arbitrary code in the context of the affected service, yielding full loss of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is insecure deserialization of untrusted data (CWE-502), and because the assessed vector carries PR:N and UI:N, no credentials or user interaction are needed, so real-world exposure is determined almost entirely by network reachability to the Guardium management/collector segment rather than by the public internet. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; IBM has published a vendor patch, which keeps this a top-tier remediation priority rather than an actively exploited emergency.

Unauthenticated remote code execution in LMDeploy 0.9.2 through 0.15.x lets any attacker who can reach a DistServe/PD-disaggregation deployment's POST /distserve/p2p_connect endpoint run arbitrary code with the privileges of the LMDeploy serving process. The endpoint accepts an attacker-supplied ZeroMQ peer address; the engine connects to it and deserializes the reply with PyZMQ's recv_pyobj(), which is backed by Python pickle and therefore executes code during object reconstruction, before any type or schema check can run. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-502); exploitation is unauthenticated only in the default configuration where the operator has not enabled API-key authentication, and no public exploit code has been identified at time of analysis. A vendor patch is available in LMDeploy 0.16.0, which replaces the pickle-based ZeroMQ protocol with JSON plus Pydantic validation.

Remote code execution in IBM MQ Java and JMS client libraries allows an authenticated attacker with access to a message queue or topic to bypass the deserialization allow-list filter in exception handling and execute arbitrary code on client applications. The flaw is network-reachable but requires low-privileged authentication (PR:L) and is limited to a specific exception-handling path (AC:H), with impact confined to the client process rather than the MQ server. No public exploit code was identified at time of analysis.

PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.

Unauthenticated remote code execution affects HGiga's OAKlouds Custom Page module in the 2.0, 3.0 and 4.0 lines at builds below 26, where an attacker who can reach the Custom Page endpoint can submit malicious serialized content and have it deserialized into arbitrary code running with the web service's privileges. The CVSS 4.0 score of 9.3 reflects the worst case for an unauthenticated network attacker (PR:N, UI:N, AT:N, high confidentiality, integrity and availability impact on the vulnerable system), and the practical limiter is exposure - whether the affected instance is reachable from untrusted networks - rather than any technical precondition. No public exploit code has been identified at time of analysis and the flaw is not currently listed as confirmed actively exploited (CISA KEV), but the low attack complexity, unauthenticated access and full-system impact make this a genuinely high-priority issue for any organization running the affected builds, and a vendor fix is available.

Arbitrary code execution is possible inside the NetBox Device Type Library's pytest validation harness because the test suite deserializes pull-request-controlled pickle cache files via pickle.load. An unauthenticated contributor can flip USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and commit a crafted tests/known-modules.pickle or tests/known-racks.pickle in the same pull request, so the payload fires whenever the tests are run: automatically by the GitHub Actions validation workflow on the PR, or by a maintainer executing pytest locally against the untrusted branch (the user-interaction requirement in the CVSS vector). Affected deployments are the repository's CI pipeline and any maintainer workstation running the suite, not NetBox servers that merely import the library's device definitions; no public exploit code has been identified at time of analysis, and GitHub Actions exposure is bounded by the read-only token granted to pull_request workflows, while a privileged local test run carries full confidentiality, integrity and availability impact.

Unauthenticated PHP object injection in b2evolution CMS 6.7.8 through 7.2.5 lets remote attackers POST crafted serialized payloads to htsrv/call_plugin.php that bypass the incomplete CVE-2016-8901 validation fix and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties. The vendor rates this 9.2 (CVSS 4.0 AV:N/AC:L/AT:P/PR:N/UI:N with VC/VI/VA:H, so unauthenticated network reach into a PHP unserialize() sink), while the independent assessment scores it high (CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C/I/A:H) because full code execution additionally requires a suitable POP gadget chain to exist in the deployed version or its active plugins; absent such a chain, impact is limited to arbitrary object instantiation and magic-method side effects. No public exploit code has been identified at time of analysis, and the affected branch is end-of-life, making unpatched legacy installs the realistic target.

Unsafe deserialization in the opt-in kedro_datasets_experimental.pytorch.PyTorchDataset connector (kedro-datasets versions 5.0.0 through <9.5.0) allows code execution during pipeline load, because the dataset calls torch.load on .pt files without enforcing weights_only=True and silently drops user-supplied load_args, so even an explicit weights_only override never reached PyTorch. Exploitation requires a PyTorch runtime earlier than 2.6 (where weights_only defaults to False) plus a victim pipeline that loads a checkpoint obtained from an attacker-influenced shared model registry, downloaded checkpoint, or partitioned external dataset; unauthenticated remote attackers can plant the payload but must wait for that user interaction, and pipelines loading only trusted files are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation; the vendor-released patch is version 9.5.0, which enforces weights_only=True by default and correctly forwards load_args and save_args.

Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.

Authenticated remote code execution in Cisco Secure Firewall Management Center (FMC) lets a low-privileged web-management user turn a crafted HTTP request into root-level command execution on the underlying appliance. The flaw is an unsecured deserialization sink in the web-management interface (CWE-502): an attacker who can reach the FMC web UI and authenticate with credentials for at least the Security Analyst (read-only) role can save a malicious payload and get it executed as root, giving a complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar - the least-privileged FMC role rather than an admin account - makes this a high-priority management-plane risk for internet- or broadly reachable deployments. Cisco Secure Firewall Management Center versions across the 7.0.x, 7.2.x, 7.3.x, 7.4.x, 7.6.x, 7.7.x and 10.0.x trains are reported as affected.

Authenticated attackers who already hold administrative credentials on a managed Cisco FTD device can escalate to root on Cisco Secure Firewall Management Center (FMC) Software and its high-availability peer by abusing the sftunnel inter-device management channel to send crafted remote procedure calls that the FMC deserializes insecurely. Because the flaw crosses a security boundary (scope change), a single compromised managed firewall yields full control over the central management platform and its HA partner, giving the issue a disproportionately large blast radius. Exploitation is not unauthenticated: it requires prior administrative access to a managed FTD (PR:H) with no user interaction, and at time of analysis there is no public exploit identified, though the high CVSS base score of 9.1 and the sensitivity of firewall management infrastructure warrant prompt attention.

Unauthenticated remote command execution as root affects Cisco Secure Firewall Management Center (FMC) Software that has the External Database Access feature configured, via insecure deserialization of a crafted Java byte stream sent to the feature's TCP port (CWE-502). Vendor scoring is 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment rates it AV:N/AC:H/PR:N/UI:N because exploitation additionally requires the attacker to control a host already listed in the external database access list and to reach that specific port - a trust relationship that gates who can hit the vulnerable endpoint. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is substantially reduced where the FMC management interface is not exposed to the public internet.

Root-level command execution on Cisco Identity Services Engine (ISE) is achievable by an authenticated, high-privileged administrator who sends a crafted serialized Java object to an affected node, allowing arbitrary commands to run on the underlying operating system. The flaw is insecure Java deserialization (CWE-502) that yields user-level OS access escalating to root, and in single-node deployments a successful exploit can also render the ISE node unavailable, so endpoints that have not already authenticated cannot reach the network until the node is restored. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the vendor's CVSS 9.1 is driven by the scope change (S:C) and full C:H/I:H/A:H impact, but exploitation requires valid high-privileged administrative credentials (PR:H), which is the primary limiting factor.

Authenticated remote code execution in Cisco ISE allows an attacker with low-privileged administrative credentials to execute arbitrary commands on the underlying operating system and elevate to root via insecure deserialization of a crafted Java object sent to the web-based management interface. Exploitation requires network access to the management interface and valid low-privileged admin credentials (CVSS 9.9, PR:L), and successful attacks on single-node deployments can cause a denial-of-service condition that prevents unauthenticated endpoints from accessing the network. No public exploit has been identified at time of analysis.

Remote code execution in InternLM LMDeploy versions 0.9.1 through 0.10.1 allows unauthenticated network attackers to run arbitrary commands by sending crafted pickle payloads to the AsyncRPCServer RPC endpoint (zmq_rpc.py). The service deserializes raw messages with pickle.loads() and performs no authentication or IP validation, so any attacker who can reach the randomized port-typically found by scanning-can trigger code execution; publicly available exploit code exists (proof-of-concept with reverse shell demo), and the CVSS 3.1 score is 9.8. This is not confirmed actively exploited (no CISA KEV listing), and exploitation is not possible if the RPC service is bound exclusively to localhost; upgrading to 0.10.2 patches the deserialization flaw and restricts the RPC to localhost.

Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), and a vendor patch is available in ObjectScale 4.4.0.0.

PHP object injection in the Cotonti 1.0.0 Comments plugin allows unauthenticated, network-reachable attackers to instantiate arbitrary PHP classes with attacker-controlled properties by feeding a crafted base64-encoded payload through the `ci` GET parameter, which is passed to unserialize() without an allowed_classes restriction. Any default Cotonti 1.0.0 deployment with the Comments plugin enabled and its widget rendering is exposed; no credentials or user interaction are required, and successful gadget-chain abuse can lead to database manipulation or remote code execution. No public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor has published an upstream fix via pull request #1889 that hardens the deserialization call.

Unsafe Java object deserialization in IBM MQ (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS / 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS / 9.4.0.0-9.4.5.1 CD, and 10.0.0.0) lets an authenticated attacker who can deliver a crafted message trigger JNDI injection and achieve arbitrary code execution inside the consuming client application rather than the queue manager itself. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5) characterizes a network-reachable but authentication-gated (PR:L) and high-complexity (AC:H) path whose scope change (S:C) derives from the code execution landing in a downstream client. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available.

Authenticated remote code execution in IBM MQ lets an attacker who holds valid MQ credentials - or who can reach a channel configured with weak or blank authentication - deliver malicious serialized data that the queue manager deserializes and executes. The flaw affects the 9.1, 9.2, 9.3, 9.4 and 10.0 streams up to their respective maintenance levels (9.1.0.0-9.1.0.37 LTS, 9.2.0.0-9.2.0.43 LTS, 9.3.0.0-9.3.0.41 LTS and 9.3.0.0-9.3.5.1 CD, 9.4.0.0-9.4.0.25 LTS and 9.4.0.0-9.4.5.1 CD, plus 10.0.0.0), giving a 8.8 CVSS base score with high confidentiality, integrity and availability impact under AV:N/AC:L/PR:L/UI:N/S:U. Because the vector requires PR:L, no unauthenticated path is confirmed; no public exploit code has been identified at time of analysis, and IBM has released a vendor fix.

Remote code execution affects IBM MQ across the 9.1 LTS, 9.2 LTS, 9.3 LTS/CD, 9.4 LTS/CD and 10.0.0.0 release lines because the queue manager deserializes untrusted data (CWE-502), letting an attacker who can already authenticate to the messaging service run arbitrary code under the broker's privileges. The flaw carries a CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and rates as a credentials-gated but fully compromising issue for any exposed MQ listener. No CISA KEV listing, EPSS score, or public proof-of-concept was present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis; patch availability is signalled by the IBM PSIRT advisory but no fixed build number is stated in the source data.

Remote code execution in WebPros WHMCS allows unauthenticated network attackers to run arbitrary code on affected installations by feeding crafted serialized data into a code path that deserializes untrusted input (CWE-502). All WHMCS builds from 9.0.0 up to (but not including) 9.0.8, and from 8.0.0 up to (but not including) 8.13.7, are affected; the vendor vector (PR:N/UI:N/AC:L) indicates no authentication or user interaction is required and that default configurations may be exposed, although the specific vulnerable endpoint or feature is not named in the advisory. No public exploit identified at time of analysis - CISA's SSVC assessment records Exploitation: none and EPSS is 0.69% (51st percentile), but the SSVC Technical Impact is rated total and Automatable is yes, so patching should be treated as high priority.

Insecure deserialization in IBM App Connect Enterprise releases 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 lets a local attacker run arbitrary code on the host running the integration node or toolkit. The flaw rates CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) with total loss of confidentiality, integrity and availability, but CISA's SSVC assessment records no known exploitation and low automatability, and no public exploit code has been identified at time of analysis. IBM has published a fix; the exact patched build is not enumerated in the supplied data, so the vendor advisory should be consulted for the precise version.

Insecure deserialization in IBM App Connect Enterprise (12.0.1.0 through 12.0.12.27 and 13.0.1.0 through 13.0.8.0) allows a local attacker to execute arbitrary code with the privileges of the affected runtime, provided the attacker can get a user or process to handle crafted serialized content. CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:N/UI:R, C/I/A all High), and CWE-502 identifies the root cause as untrusted deserialization. No public exploit code has been identified and CISA's SSVC assessment records exploitation status 'none' with automatable 'no'; IBM has published a vendor fix referenced in its support advisory.

Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.

Unauthenticated remote code execution affects ModelTC's LightLLM LLM inference framework in all versions through 1.2.0, where the Config Server's /visual_register WebSocket endpoint deserializes the first client frame with pickle.loads() without any authentication. An attacker who can reach the Config Server port can send a crafted pickle payload whose __reduce__ method runs arbitrary commands with the privileges of the Config Server process. Reported by VulnCheck; a proof-of-concept exists (SSVC exploitation=poc) though the flaw is not listed in CISA KEV.

Arbitrary code execution in ESPnet before v.202609 is triggered when a user loads an attacker-crafted PyTorch checkpoint through any of the framework's model initialization, fine-tuning, or averaging pipelines. The root cause is CWE-502 (Deserialization of Untrusted Data): ESPnet called torch.load with weights_only=False across at least four distinct code paths, allowing pickle-embedded payloads to execute arbitrary commands with the privileges of the ESPnet process. No public exploit has been identified at time of analysis, but the attack technique - crafting malicious PyTorch pickle checkpoints - is thoroughly documented in the ML security community and requires minimal skill to reproduce.

Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.

Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.

PHP Object Injection in the wpstorecart WordPress plugin (through 5.0.7) exposes an unauthenticated deserialization endpoint bundled as an add-on, permitting attackers to inject arbitrary PHP objects without class restrictions. Exploitation to full system compromise (RCE) is contingent on the presence of a suitable POP gadget chain elsewhere in the WordPress environment - a condition that is common on complex WordPress installations running multiple plugins. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting low current exploitation activity.

Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.

Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.

PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.

Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.

PHP object injection in FileRun before 2026.3.0 enables authenticated attackers with database write access to achieve remote code execution via a misconfigured unserialize() call in Perms::getPerms(). A positional array is passed instead of a named-key array to set allowed_classes, causing PHP to ignore the class instantiation restriction entirely; a serialized gadget chain injected into the permissions table is deserialized on every subsequent authenticated page load, allowing arbitrary file writes - including PHP webshells - to web-accessible paths. VulnCheck reported this flaw with a publicly available proof-of-concept; a vendor patch is available in version 2026.3.0, and no confirmed active exploitation appears in CISA KEV at time of analysis.

Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.

PHP object injection in the Site Reviews WordPress plugin before 8.3.0 allows unauthenticated remote attackers to deserialize arbitrary PHP objects on installations where the WordPress nonce key is absent, set to its sample/placeholder value, or too short to be secret. The plugin derives its deserialization protection key by padding the site's nonce key, making that derived key trivially computable under these common misconfiguration conditions. Exploitation impact is chained to PHP gadget chains present in other installed plugins or themes; no confirmed active exploitation (SSVC: none), but a public POC exists and full site compromise - including code execution, credential theft, and data loss - is achievable on sites with both a weak nonce key and a usable gadget chain.

PHP object injection in MaxSite CMS through version 109.6 lets unauthenticated remote attackers forge valid ci_session cookies and pass attacker-controlled serialized data to an unrestricted unserialize() call. Because the framework ships a hardcoded encryption key, an attacker can sign forged session cookies that pass integrity checks, instantiate arbitrary PHP objects, and trigger magic methods to corrupt application state or achieve remote code execution when suitable gadget classes are present. Publicly available exploit code exists (reported by VulnCheck); this is a deserialization flaw (CWE-502) with a full-impact CVSS 4.0 score of 9.2.

Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.

Deserialization in t-digest 3.1 through 3.3 allows remote attackers to inject IEEE 754 NaN values as centroid means via crafted byte streams passed to MergingDigest.fromBytes(), bypassing absent validation checks. The injected NaN values corrupt the internal total-ordering invariant of the centroid list, causing sort comparisons to return inconsistent results and degrading subsequent merge operations from O(n log n) to O(n²) algorithmic complexity. The result is severe CPU exhaustion and service delays for any application that deserializes attacker-controlled t-digest payloads; no public exploit code or CISA KEV listing exists at time of analysis.

Remote code execution in Microsoft Office Publisher allows a network-based attacker to execute arbitrary code on a victim's machine by exploiting unsafe deserialization of untrusted data in Publisher file parsing. Affected products span the full Office ecosystem including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Publisher 2016, and Office 2019. Exploitation requires user interaction - the victim must open a crafted Publisher file - but no authentication or elevated privileges are needed from the attacker's side. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution in Microsoft SQL Server 2019, 2022, and 2025 is achievable by an authenticated low-privilege attacker via deserialization of untrusted data (CWE-502) delivered over the network. The flaw covers multiple build tracks across three major SQL Server versions, with full confidentiality, integrity, and availability impact on the database host. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation in Windows IP Address Management (IPAM) allows an authenticated local user on any of a broad range of unpatched Windows 10, 11, and Windows Server releases to obtain full system-level control by supplying a crafted serialized payload to the IPAM service. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 7.0 under a local, high-complexity attack vector with full C:H/I:H/A:H impact. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the complete impact triad makes successful exploitation severely damaging on any affected host.

Remote code execution in Microsoft Dynamics 365 on-premises version 9.1 (prior to build 9.1.0046.0006) is achievable by an authenticated low-privileged attacker via deserialization of untrusted data over the network. The CWE-502 flaw allows crafted serialized objects to be processed without adequate validation, yielding full confidentiality, integrity, and availability compromise of the affected server. No public exploit code has been identified at time of analysis; Microsoft has released a patch addressing this vulnerability.

Remote code execution via deserialization of untrusted data in Microsoft SQL Server 2019, 2022, and 2025 allows an unauthenticated network attacker to achieve full system compromise with high complexity exploitation conditions. The vulnerability (CWE-502) exists in SQL Server's handling of serialized objects over the network, enabling attackers to trigger code execution without authentication. No public exploit or KEV listing is confirmed at time of analysis, though vendor-released patches are available across all three major affected release lines.

Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker to run arbitrary code on the server by submitting crafted serialized data that the application deserializes without validation (CWE-502). Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, making this a critical (9.9) server-compromise issue. No public exploit was identified at time of analysis; the flaw was reported by the vendor and a fixed version (2026.2) is available.

Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.

Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. No public exploit is identified at time of analysis and the CVE is not on CISA KEV, but the flaw class and pre-auth network reach make it a high-priority patch.

Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.

PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution in Hitachi Cosminexus Component Container arises from unsafe deserialization of untrusted data (CWE-502) across a broad range of 09-xx and 11-xx releases. Per the CVSS vector an unauthenticated remote attacker who can deliver a crafted serialized object to a vulnerable endpoint can achieve full confidentiality, integrity, and availability compromise. Hitachi has released fixed maintenance versions; no public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV.

Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Remote code execution in Next4Biz CSM (Customer Service Management) up to build 07092026 allows unauthenticated attackers to inject and execute code by supplying crafted serialized objects that the application deserializes without validation (CWE-502). Reported by Turkey's national CSIRT (TR-CERT/USOM); the vendor was contacted but did not respond, and no fixed build is confirmed. No public exploit identified at time of analysis, and no KEV/EPSS enrichment is available in the provided data.

Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clients to achieve remote code execution by sending crafted ObjectMessage payloads. The flaw stems from a logical inversion in the allow-list guard: when no allow-list is configured (the default), `isTrustedType()` unconditionally returns true, rendering the entire class-filtering mechanism inoperative. Affected products include Red Hat AMQ Broker 7, JBoss EAP 7 and 8, and Red Hat builds of Apache Camel - all widely deployed in enterprise Java environments. No public exploit or KEV listing has been identified at time of analysis, but deserialization gadget chains targeting common Java libraries are extensively documented.

Remote code execution in the Mail Mint WordPress plugin (by getwpfunnels) affects all versions up to and including 1.31.0, where the 'handle_form_submission' function deserializes untrusted, attacker-supplied input (CWE-502). Because a usable POP (property-oriented programming) gadget chain is present in the plugin's bundled code, unauthenticated attackers can move from PHP Object Injection to arbitrary code execution on the server. The vendor only partially addressed the flaw in 1.23.1, meaning early-'fixed' installs may remain exploitable; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerability.

PHP Object Injection in the Welcart e-Commerce WordPress plugin (all versions ≤ 2.12.1) enables unauthenticated attackers to inject a serialized POP-chain payload as order metadata during a public checkout, then trigger deserialization through the unprotected Telecom EDY payment callback. Exploitation via a bundled TCPDF POP chain can delete arbitrary server files - including wp-config.php - and culminates in full remote code execution when the attacker re-runs the WordPress installer against an attacker-controlled database. Successful file deletion requires an administrator to print an order invoice, captured by UI:R in the CVSS vector; no public exploit or CISA KEV listing has been identified at time of analysis.

PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-privilege users to supply arbitrary PHP-serialized payloads through the writable `context` prop, leading to potential remote code execution on the hosting server. The root cause is direct use of PHP's `unserialize()` on client-controlled input without validation or type restriction, confirmed by GitHub Security Advisory GHSA-4gj8-frx2-gmp6. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full server compromise (C:H/I:H/A:H).

Unauthenticated buffer over-read in MOOS core-moos through 10.4.0 allows any attacker with TCP access to the MOOSDB port to crash the server or leak process memory by sending a crafted 4-byte packet. The CMOOSCommPkt deserialization path fails to validate that the declared packet length meets the minimum header size before calling Serialize(), causing it to read the message-count field from memory beyond the end of the received data. No authentication is required - exploitation precedes any credential exchange, making this reachable on any exposed MOOSDB instance. No public exploit has been identified at time of analysis, but the fix PR (GitHub #75) precisely documents the trigger condition.

PHP Object Injection in the eyecix JobSearch (wp-jobsearch) WordPress plugin allows remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, affecting all versions up to and including 3.2.0. Because the vector is unauthenticated (PR:N), any visitor can supply malicious input; if a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the RTMKit WordPress plugin (versions ≤ 2.1.5) allows an authenticated Contributor-level user to pass a crafted serialized PHP payload through a vulnerable plugin input, triggering deserialization of untrusted data. In plugin-rich WordPress environments where PHP gadget chains are commonly available, this escalates to remote code execution, full database access, and file system compromise. No confirmed active exploitation or public exploit code has been identified at time of analysis; the vulnerability was disclosed by Patchstack.

Arbitrary OS command execution in SEPPmail Secure Email Gateway before 15.0.6 is possible via CWE-502 deserialization in the privileged REST API import workflow. An attacker who holds a privileged API token can submit a crafted serialized payload to the import endpoint and trigger command execution under the 'nobody' system account. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the attack pattern for deserialization vulnerabilities is well understood.

Unrestricted Java deserialization in Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier enables any user holding Item/Configure permission to execute arbitrary code on the Jenkins controller. The plugin stores performance test results as serialized Java objects in the build directory and reads them back without enforcing a class allowlist, enabling classic gadget-chain exploitation (CWE-502). No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable delivery, but technical impact is rated total - full Jenkins controller compromise.

Unsafe Java deserialization in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) allows authenticated users with configuration-submission permissions to control the values of transient fields during deserialization, with impact ranging up to full server compromise depending on how those fields are used internally. Transient fields in Java are normally excluded from serialization to protect derived or sensitive state; this flaw breaks that guarantee when processing externally supplied configuration data. No public exploit code or active exploitation has been confirmed at time of analysis, but given Jenkins' role as a CI/CD orchestrator with broad network access and secrets, the blast radius of exploitation is significant.

Unsafe type instantiation during form data binding in Jenkins Stapler allows low-privileged authenticated users to trigger instantiation of arbitrary object types unrelated to the intended field type, achieving full compromise (C:H/I:H/A:H) of the Jenkins controller. Affected are Jenkins 2.579 and earlier and LTS 2.568.2 and earlier, via Stapler 2107.v8dfcb_e8ed317 and earlier (excluding the backport 2088.2093.vd7c3e58008a_6). The root cause is CWE-502-class unsafe deserialization/type-binding: Stapler fails to constrain which Java types may be instantiated when processing attacker-controlled HTTP form submissions. No public exploit code or CISA KEV listing is identified at time of analysis, but Jenkins is pervasively deployed in CI/CD pipelines and the low privilege bar (Overall/Read) makes this a high-priority patch target.

PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.

PHP Object Injection in the WP User Frontend WordPress plugin (versions ≤ 4.3.10) allows any subscriber-level authenticated attacker to submit crafted serialized PHP payloads over the network, triggering unsafe deserialization. If a usable gadget chain exists among the site's installed plugins or themes - common in the broad WordPress ecosystem - this can escalate to arbitrary code execution, file write, or full site compromise. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.

PHP Object Injection in the User Frontend WordPress plugin (versions before 4.3.11) allows any authenticated subscriber-level user to trigger deserialization of attacker-controlled field values by reopening a previously submitted post in the plugin's frontend editing form. If a suitable PHP gadget chain is present in the WordPress installation - supplied by other installed themes or plugins - this escalates to full remote code execution. A public proof-of-concept is available via WPScan, making exploitation accessible to low-skilled attackers on vulnerable installs.

PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.

Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deployment privileges to execute arbitrary attacker-controlled logic on the Elasticsearch host node by supplying a crafted trained model artifact. The flaw stems from unsafe deserialization (CWE-502) of model artifact data during the ML inference loading process, granting the attacker a broader OS system-call surface than the ML subsystem is intended to expose. Elastic has released fixed versions 8.19.2, 9.4.5, and 9.5.1 via ESA-2026-114; no public exploit code or CISA KEV listing has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.

Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.