Insecure Deserialization

Deserialization of untrusted data in TUBITAK BILGEM's eta-otp-lock (all versions before 1.0.4) enables object injection leading to full system compromise on affected hosts. The attack requires local access and user interaction with a malicious serialized payload, resulting in high confidentiality, integrity, and availability impact (CVSS 7.8). TR-CERT has confirmed the issue under advisory TR-26-0730; a vendor patch exists at version 1.0.4, and no public exploit code or CISA KEV listing has been identified at time of analysis.

PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.

PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.

Deserialization of untrusted data in Canon PRISMAproduction version 6.5 and earlier enables adjacent-network attackers to achieve arbitrary code execution without credentials. The CVSS 4.0 vector (AV:A/AC:H/PR:N) indicates exploitation requires physical or logical network adjacency and elevated attack complexity, but successful exploitation yields full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Canon PSIRT has published an advisory (cp2026-007) acknowledging the issue.

PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.

Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.

PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.

Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.

Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.

Remote code execution in IBM webMethods Integration (on-prem) 10.15 and 10.11 allows an unauthenticated network attacker to run arbitrary code by submitting maliciously crafted serialized data that the platform deserializes without validation (CWE-502). Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full CIA impact (9.8 Critical), exploitation requires no credentials and no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the vendor (IBM) has released a patch, indicating a confirmed, fixable flaw.

Second-order PHP code execution in e107 CMS before version 2.3.8 lets an attacker who already holds out-of-band write access to the database plant a crafted payload in the user_prefs column, which is later fed to eval() when that user's preferences load. The e_array::unserialize() handler validates only that the stored string begins with 'array' before evaluating it, so any account whose preferences are materialized triggers arbitrary PHP execution. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.

PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users with subscriber-level access or higher to deserialize attacker-controlled data through XProfile textbox fields, which can escalate to remote code execution when a usable POP gadget chain exists in the WordPress stack. The flaw stems from bp_unserialize_profile_field() calling @unserialize() on user-supplied profile data without the allowed_classes safeguard. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the moderate CVSS of 7.5 reflects the dependency on an available gadget chain (high attack complexity).

Remote code execution in the Aimy Captcha-Less Form Guard plugin for Joomla (versions 18.0 through 20.0) allows unauthenticated attackers to run arbitrary PHP by submitting a forged 'clfgd' form field that the plugin deserializes, triggering PHP object injection. Any unpatched Joomla site running this plugin is exposed to full server compromise over the network without authentication or user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CWE-502 root cause and maximal CVSS 4.0 score (10.0) make this a critical-priority issue.

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.

Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.

Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization, ultimately executing arbitrary commands on the server. The vulnerability is reachable via the assessment overall answer endpoint and permits writing a webshell to a publicly accessible location. No active exploitation (KEV) or public exploit code has been confirmed at this time.

Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.

Pre-authentication unsafe deserialization in IBM WebSphere Application Server 9.0 and 8.5 traditional allows remote unauthenticated attackers to execute arbitrary code or bypass authentication. CVSS 9.8 indicates critical severity with low attack complexity and no user interaction, though no public exploit code or active exploitation has been identified at time of analysis.

Remote code execution in IBM WebSphere Application Server 8.5 and 9.0 (traditional) allows an unauthenticated network attacker to run arbitrary code by sending crafted serialized data that the server deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 rating with a network attack vector and no authentication or user interaction required, though SSVC records exploitation as none observed and no public exploit was identified at time of analysis. EPSS is low at 0.37% (29th percentile), indicating that active, widespread exploitation has not yet materialized despite the maximal technical impact.

Unauthenticated remote code execution in 3DEXPERIENCE Station Launcher App from Release R2023x through R2026x allows attackers to execute arbitrary commands on affected systems without any authentication. The flaw stems from deserialization of untrusted data (CWE-502) and carries a maximum CVSS 10.0 score. No active exploitation or public exploit code is reported at time of analysis, though the network‑accessible attack surface presents significant risk.

Remote code execution in Apache Axis2/Java through 2.0.0 arises from unsafe deserialization of Java objects in the optional Tribes clustering component, allowing unauthenticated remote attackers with network access to the clustering port to execute arbitrary code via crafted serialized payloads. The vulnerability is only exploitable when clustering is explicitly enabled, which is off by default. No active exploitation or public exploit code has been observed; the issue is resolved by upgrading to version 2.0.1, which removes the entire clustering feature.

Low-privileged users can exploit a deserialization flaw in JFrog Artifactory's package handling to potentially execute arbitrary code, compromising system confidentiality, integrity, and availability. The vulnerability is triggered under specific repository conditions. At time of analysis, no public exploit or active exploitation has been confirmed.

Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.

Heap-based buffer overflow in HDF5 through 2.1.1 enables attackers to crash applications and potentially corrupt data by providing a crafted HDF5 file. The flaw lies in the shared‑message list‑index deserializer (SOHM), allowing out‑of‑bounds heap reads and writes when a num_messages field exceeds the declared list_max. No active exploitation has been reported, but the issue is publicly documented and a proof‑of‑concept may exist in the linked issue.

An authenticated PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress (versions ≤6.2.6) allows a user with Subscriber-level privileges to inject a malicious serialized PHP object via deserialization of untrusted input. If a suitable POP chain is present and the user update integration is enabled with a mapped user meta field, the attacker can change user passwords and ultimately take over administrator accounts. Public exploit code is available, but the EPSS score (0.38%) suggests low real-world exploitation probability and the vulnerability is not listed in CISA's KEV.

Remote code execution in OpenAM's WebAuthn authentication module allows unauthenticated attackers to bypass an incomplete deserialization filter. The filter only constrains the root object, letting any nested gadget chain execute if a vulnerable library is on the classpath, leading to full server compromise. No public exploit or active exploitation has been reported, but the detailed advisory provides sufficient information for skilled attackers to develop exploits.

Deserialization type confusion in seroval.fromJSON() allows remote code execution in applications that process untrusted JSON with plugins enabled. Versions prior to 1.5.3 are affected. No public exploit is available, but a private reproducer confirms the issue.

Remote code execution in Microsoft 365 Copilot allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). The flaw carries a CVSS 9.9 rating driven by a scope change and full confidentiality, integrity, and availability impact, and because Copilot is a Microsoft-hosted cloud service, exploitation would affect the shared multi-tenant platform. No public exploit identified at time of analysis (CVSS exploit maturity is Unproven), but a vendor fix has been released via MSRC.

Deserialization of untrusted data in Johnson Controls victor video management software (versions 2.9 up to but not including 3.0) on Windows allows an adjacent-network attacker to trigger object injection (CAPEC-586) and achieve high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector (AV:A/PR:N/UI:N) indicates unauthenticated exploitation is possible for an attacker positioned on the same local network segment, with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the Complianz WordPress plugin (all versions up to and including 7.5.0) allows an authenticated user with Administrator privileges to inject serialized PHP objects that the plugin later deserializes, enabling arbitrary object instantiation and potential remote code execution or data manipulation. The flaw stems from unsafe deserialization (CWE-502) and carries a CVSS 7.2 (High). No public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Patchstack.

PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated PHP Object Injection in the Thrive Quiz Builder WordPress plugin (versions 10.9.3.0 and earlier) lets remote attackers inject crafted serialized PHP objects that are deserialized by the plugin, enabling POP-chain abuse that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 with a fully network-reachable, no-privilege, no-interaction vector, making any unpatched site running the plugin a high-value target. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises from unsafe .NET type resolution in the persistence framework, where attacker-influenced persisted state is deserialized into arbitrary object types. Network-reachable attackers can leverage this to run arbitrary code on the hosting web server, though the CVSS High attack complexity (AC:H) indicates exploitation depends on influencing persisted state rather than a trivial single request. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the deserialization class and product history warrant urgent patching.

Remote code execution in Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708 arises when the file-based persistence storage provider derives its storage key from user-controlled input, letting a remote attacker steer a path traversal into attacker-controlled deserialization. Because the CVSS vector is PR:N/UI:N, an unauthenticated remote attacker can chain the traversal to load a crafted serialized payload and execute arbitrary code, though the AC:H rating signals the attack is non-trivial to reliably trigger. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Remote code execution in Progress Telerik UI for ASP.NET AJAX before v2026.2.708 arises when applications persist state via cookie-based storage in RadPersistenceManager or RadDockLayout, causing the components to deserialize attacker-supplied cookie payloads. An unauthenticated remote attacker who can reach the application and craft a malicious serialized cookie can achieve code execution on the server. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; EPSS data was not provided.

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 allows a remote unauthenticated attacker to compromise the confidentiality and integrity of all Java-accessible data via APIs reachable over multiple network protocols. Rated CVSS 3.1 7.4 (High) by Oracle, the flaw is difficult to exploit (AC:H) and carries no availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It also affects sandboxed Java Web Start/applet deployments that run untrusted code and rely on the Java sandbox.

Improper deserialization of untrusted data in NVIDIA Transformers4Rec (all versions per CPE wildcard) exposes systems running the library to code execution, data tampering, and information disclosure via a local attack path. The official CVSS vector assigns C:N/I:N/A:L - a score of 4.3 - which is materially inconsistent with the vendor's own description of potential remote code execution and data tampering; this discrepancy warrants independent verification with NVIDIA's product security team. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.

Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile), but the network-reachable, unauthenticated attack surface makes it a meaningful hardening priority for exposed services.

Remote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises because attacker-supplied data can bypass the class-registration allowlist during Java lambda deserialization, with the gap confined to the lambda capture class. Registration checks are Fory's core defense against untrusted-deserialization gadget attacks, so bypassing them for lambda payloads can let an attacker instantiate otherwise-disallowed classes and reach code execution or memory corruption. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; the vendor (Apache) rates it CVSS 9.8 and a fixed release (1.4.0) is available.

Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.

Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.

Remote code execution in ktransformers (kvcache-ai) through version 0.6.3 allows unauthenticated attackers to run arbitrary shell commands by sending crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket, which is bound to all network interfaces (0.0.0.0). The flaw stems from unsafe pickle deserialization of RPC messages, letting an attacker weaponize a malicious __reduce__ method to execute code as the server process. Publicly available exploit code exists and VulnCheck published an advisory; there is no public exploit identified in CISA KEV, so this is not yet confirmed as actively exploited.

Authenticated remote code execution in Wazuh's Cluster Distributed API (DAPI) lets any peer holding the shared cluster key coerce the master node into deserializing an attacker-controlled callable (CWE-502) and running it under a forged RBAC context, yielding full manager compromise. Rated CVSS 9.1 and affecting all cluster deployments from 4.0.0 up to the 4.14.5 fix, it combines an overly broad deserialization allowlist with client-controlled authorization to bypass permission checks entirely. SSVC records a proof-of-concept, so publicly available exploit code exists, though EPSS remains low at 0.19% (9th percentile), consistent with a signal that requires possession of the cluster key rather than opportunistic mass exploitation.

Arbitrary code execution in keras-team/keras 3.15.0 arises because the public keras.layers.TorchModuleWrapper.from_config method calls torch.load(..., weights_only=False) without any explicit unsafe opt-in, so a maliciously crafted Keras layer configuration deserialized outside a SafeModeScope(True) context triggers execution of attacker-controlled PyTorch pickle payloads (CWE-502). Any application or pipeline that loads untrusted or third-party Keras model/layer configs is affected; CVSS is 7.8 (High) with a local vector requiring user interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the vulnerability class is well understood and reliably weaponizable via standard pickle reduce gadgets.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.

Crash-inducing out-of-bounds panic in core-rs-albatross 1.5.1 and earlier allows a malicious state-sync peer to repeatedly restart a syncing Nimiq node without supplying a valid cryptographic proof. The panic fires in `KeyNibbles::Add` before `proof.verify()` is reached, meaning an unauthenticated network peer positioned as the victim's sync source can trigger the denial-of-service with a single crafted `TrieChunk` message. No CISA KEV listing exists and no public exploit code has been identified at time of analysis.

Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable interface without authentication or safe deserialization, letting a network attacker send a crafted pickle payload that executes arbitrary code in the serving process. It affects deployments where the elastic expert-parallel backup feature is enabled and the socket is reachable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Arbitrary file deletion in the Uncanny Automator WordPress plugin (all versions through 7.3.1.4) lets unauthenticated attackers delete any file on the server via untrusted PHP object deserialization in the fr_token function, and deleting a critical file such as wp-config.php can pivute WordPress into an installation/setup state that yields remote code execution. Exploitation is gated by a specific setup: a Forminator form must be connected to an Uncanny Automator recipe whose trigger is configured for 'Everyone', which is what exposes the deserialization sink to anonymous form submissions. A self-contained gadget chain via Action_Helpers_Email::__destruct() ships inside the plugin, so no external gadget library is needed; reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.

Code execution in NVIDIA TensorRT (all versions through v10.16.1) arises from unsafe deserialization of untrusted data (CWE-502), letting an attacker who supplies a malicious serialized artifact run arbitrary code in the context of the inference process. It affects the TensorRT SDK/runtime used to optimize and execute deep-learning models. The vendor-assigned CVSS is 9.8, but there is no public exploit identified at time of analysis, EPSS is low (0.48%, 38th percentile), and CISA SSVC lists exploitation as 'none'.

Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged attacker to submit malicious payloads over the zeroMQ channel and achieve arbitrary code execution. The vulnerability stems from the visual gen server accepting and deserializing zeroMQ messages without enforcing adequate authorization controls, exposing CWE-502 deserialization risks. No public exploit has been identified at time of analysis, EPSS rates exploitation probability at 0.22% (12th percentile), and SSVC confirms no known active exploitation - though technical impact is rated total given full C/I/A compromise potential.

Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attacker corrupt heap memory by supplying a crafted serialized tensor, potentially causing information disclosure, data tampering, or denial of service. All platforms running affected TensorRT-LLM versions are impacted. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; NVIDIA rates exploitation as high-complexity (AC:H).

Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a host running the inference stack abuse its inter-process communication layer to trigger unsafe object deserialization (CWE-502), potentially yielding code execution, information disclosure, data tampering, and denial of service. The flaw is vendor-reported by NVIDIA and carries a CVSS 3.1 base of 7.8 (AV:L), meaning it is not remotely reachable but converts existing local access into full compromise of the model-serving process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the restricted unpickler that handles model-weight loading, potentially achieving code execution, privilege escalation, data tampering, and information disclosure. The flaw (CWE-502, CVSS 8.4) affects the GPU LLM-inference library and stems from the restricted unpickler failing to fully constrain what can be deserialized from an untrusted model artifact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Local code execution in Microsoft .NET 8.0 and 9.0 (and bundled Visual Studio 2022/2026 toolchains) arises from unsafe deserialization of untrusted data (CWE-502), letting an unprivileged local attacker run arbitrary code in the context of the targeted process once a user is lured into opening or processing a malicious serialized payload. The CVSS 3.1 base score is 7.8 with high impact to confidentiality, integrity, and availability, but the vector (AV:L/UI:R) confines it to local attacks that require user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in Microsoft Dynamics NAV 2018 allows an unauthorized, network-based attacker to run arbitrary code by submitting maliciously crafted serialized data that the application deserializes without validation (CWE-502). With a CVSS 9.8 vector requiring no authentication and no user interaction, successful exploitation grants full compromise of the ERP host. Microsoft has released a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Local privilege escalation in the Windows Wireless Wide Area Network Service (WwanSvc) lets an authenticated low-privileged user elevate to SYSTEM by delivering crafted serialized data that the service deserializes unsafely (CWE-502). Reported by Microsoft, it affects a broad range of Windows 10, Windows 11, and Windows Server builds and carries CVSS 7.8 with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV, but a vendor patch is available.

Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrupt service availability by sending crafted serialized data that triggers unsafe deserialization (CWE-502). The flaw carries a CVSS 7.5 (High) with a fully network-reachable, no-privilege, no-interaction vector, but impact is confined to availability - confidentiality and integrity are not affected. Microsoft has released a fix via MSRC; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an unauthenticated network attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). The CVSS 3.1 base score is 9.8 with a fully remote, no-interaction, no-privilege vector (AV:N/AC:L/PR:N/UI:N), placing it among the most severe SharePoint flaws. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but insecure-deserialization RCE in SharePoint has historically been a high-value target for rapid weaponization.

Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated attacker run arbitrary code by sending a crafted serialized payload over the network. The flaw is an untrusted-data deserialization (CWE-502) rated CVSS 9.8 with PR:N/UI:N, meaning no credentials or user interaction are required. No public exploit identified at time of analysis, but the pre-auth network vector and SharePoint's long history as an attacker target make this a high-priority patch.

Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker to run arbitrary code on the database server by sending crafted data that the engine deserializes unsafely (CWE-502). Any account able to submit queries or data over the network to a vulnerable instance can achieve full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating and the RCE-with-low-privilege profile make it a high-priority patch.

Remote code execution in Microsoft SQL Server 2025 (CU6 and the x64 GDR branch) lets an authenticated attacker run arbitrary code across the network by supplying maliciously crafted serialized data that the server deserializes without validation (CWE-502). The flaw was reported by Microsoft, carries a CVSS 3.1 base score of 8.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows an already-authenticated attacker with low privileges to elevate to higher privileges by abusing unsafe deserialization of untrusted data. Microsoft reported the flaw and has released a patch; no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.8 (High), reflecting full confidentiality, integrity, and availability impact on the affected host.

Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.

Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.

Denial-of-service in the Storable module for Perl (versions before 3.41) allows remote attackers to abort deserialization by supplying a crafted SX_HOOK record whose item count equals I32_MAX. The signed 32-bit count plus one wraps to a negative value, which av_extend rejects with a fatal panic, terminating any thaw() or retrieve() call on attacker-controlled data. No public exploit identified at time of analysis; despite the assigned CVSS of 9.8 (C:H/I:H/A:H), the documented outcome is a controlled abort rather than memory corruption or code execution.

PHP Object Injection in the ShapedPlugin Real Testimonials (testimonial-free) WordPress plugin affects all versions up to and including 3.1.15, allowing a high-privileged authenticated user to inject serialized PHP objects that the plugin unsafely deserializes. Depending on gadget chains present in WordPress core, other active plugins, or themes, this can escalate to arbitrary code execution, data disclosure, or site compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the ThemeGoods Grand Photography WordPress theme (all versions up to and including 5.7.8) lets remote attackers deliver crafted serialized data to an unsafe unserialize() sink, potentially achieving code execution, file operations, or SQL injection through POP gadget chains. The CVSS 9.8 rating reflects unauthenticated network exploitation (PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

PHP Object Injection in the RT-Theme 18 | Extensions plugin (rt18-extensions) for WordPress affects all versions up to and including 2.5, allowing remote attackers to inject arbitrary PHP objects by supplying crafted serialized data to an unsafe deserialization sink. Because the CVSS vector reports PR:N/UI:N, exploitation does not require authentication or user interaction, and impact escalates to full compromise (confidentiality, integrity, availability all High) when a usable POP gadget chain is present in the WordPress stack. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 base score reflects worst-case object-injection potential rather than confirmed in-the-wild activity.

Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.

PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.3.6, letting remote attackers deserialize untrusted data and instantiate arbitrary PHP objects. When paired with a suitable POP gadget chain present in the plugin, WordPress core, or another installed plugin, this can escalate to remote code execution, data theft, or site takeover. Reported by Patchstack with a CVSS of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV, though the network vector combined with only requiring user interaction makes it a serious patch priority.

PHP Object Injection in the WPJAM Basic WordPress plugin (denishua) affects all versions up to and including 7.0, allowing an authenticated attacker to inject crafted serialized objects that are deserialized by the plugin. Reported by Patchstack and rated CVSS 8.8, it can lead to high-impact compromise (confidentiality, integrity, and availability) of the WordPress site, though exploitation requires at least low-level authenticated access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP object injection in the 'Database for Contact Form 7, WPforms, Elementor forms' WordPress plugin (all versions before 1.5.2) permits unauthenticated attackers to embed malicious serialized PHP objects via the entry-editor file-field path, which are instantiated server-side when an administrator views the stored form entry. This is an incomplete remediation of two prior CVEs (CVE-2025-7384 and CVE-2026-2599) - earlier patches hardened other deserialization paths within the same plugin while this specific code route was overlooked. A publicly available exploit exists; no active exploitation is confirmed by CISA KEV at time of analysis.

Unsafe deserialization in AkariAsai self-rag's `Indexer.deserialize_from` function exposes any deployment that processes externally supplied FAISS index files to potential arbitrary code execution. The vulnerability resides in `retrieval_lm/src/index.py` and is triggered when the `index_meta.faiss` argument is manipulated with a crafted payload - a classic CWE-502 pattern where Python's serialization routines (typically pickle) blindly instantiate attacker-controlled objects. A publicly available proof-of-concept exists per GitHub issue #105, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.3. No active exploitation has been confirmed by CISA KEV, and the project maintainer had not formally responded to the disclosure at time of reporting.

Unsafe deserialization in HashNeRF-pytorch's Checkpoint File Handler allows a local low-privileged attacker to achieve arbitrary code execution by supplying a malicious file via the `ckpt_path` argument to `torch.load()` in `run_nerf.py`. All commits up to 82885e698295982504eb6a26d060a6b2473e3706 are affected; a fix exists as an unmerged pull request (PR #50). A public exploit has been disclosed via GitHub issue #49, though no CISA KEV listing has been identified, indicating no confirmed widespread active exploitation at time of analysis.

Unsafe deserialization in pyod 3.5.0-3.5.2 exposes the `pyod.utils.persistence.load` function to remote exploitation by authenticated low-privilege users who can manipulate the `path` argument. Rooted in CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload supplied via the path parameter to be deserialized without adequate validation, potentially yielding code execution or data manipulation within the running process. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; an upstream fix is available as GitHub PR #698, though a formally versioned PyPI release incorporating the patch has not been independently confirmed.

Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by luring a victim into interacting with crafted content that triggers unsafe deserialization (CWE-502). The flaw carries CVSS 8.3 with a scope change, meaning successful exploitation can break out of the browser's security boundary, though there is no public exploit identified at time of analysis and Microsoft has already shipped a fix.

Remote code execution in Spinnaker's Rosco bakery service allows an authenticated user to run arbitrary code on Rosco pods by supplying a manifest that abuses unsafe YAML tag processing during Kustomize bake operations. The flaw (CWE-502 unsafe deserialization) affects release lines prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4, and grants full compromise of the affected pod (C:H/I:H/A:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-published GitHub Security Advisory (GHSA-p68j-q7hf-3qcp) and multiple fix commits confirm the issue is real and patched.

Unauthenticated remote code execution in the PrestaShop ps_facetedsearch (layered navigation) module versions 3.0.0 through 4.0.3 allows a single crafted front-office request to fully compromise the shop and its underlying server. The module rebuilds price/weight slider filter values from the request URL and later reads them back through a native unserialize(), enabling PHP object injection whose gadget chain writes a PHP webshell into the module directory. No public exploit is identified at time of analysis, but the flaw is trivially reachable and rated CVSS 10.0.

Arbitrary Python code execution in BabelDOC (funstory-ai, pip package `babeldoc`) prior to 0.6.3 allows an attacker to run code in the context of the translation process by having a victim process a crafted PDF. The vendored pdfminer CMap loader (`cmapdb.py::_load_data`) strips only NUL bytes from a PDF-controlled CMap/Encoding name and passes it to `pickle.loads()`, so a hex-encoded absolute path in the PDF's `/Encoding` name redirects deserialization to an attacker-planted `.pickle.gz` file. A detailed, working proof-of-concept exists (publicly available exploit code exists); there is no CISA KEV listing and no public evidence of active exploitation at time of analysis.

Remote command execution in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged authenticated user to run arbitrary OS commands with root privileges by abusing unsafe deserialization of untrusted data (CWE-502). Because the CVSS vector is AV:N/AC:L/PR:L, any account with minimal access on the management interface can escalate to full root control of the storage-management appliance. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the low attack complexity and full CIA impact make it a high-priority patch for storage administrators.

PHP object injection in YesWiki's BazaR import feature allows an attacker to reach an unsafe unserialize() sink in tools/bazar/services/CSVManager.php, where attacker-supplied base64 data is deserialized without allowed_classes=false, instantiating arbitrary classes and triggering magic methods (__destruct, and __toString via array_map('strval')). Because the importentries mode lacks CSRF protection (the assigned root cause CWE-352), a remote attacker can host an auto-POSTing HTML page that, when visited by a logged-in wiki admin, drives the deserialization using the admin's session - chaining published Doctrine PHPGGC gadgets into remote code execution on the host. Publicly available exploit code exists demonstrating the object-injection primitive, but no full end-to-end RCE chain is published and this is not confirmed actively exploited (not in CISA KEV).

Second-order SQL injection in YesWiki v4.6.5 lets any authenticated low-privilege user execute arbitrary SQL against the wiki database through the DELETE /api/pages/{tag} endpoint. An attacker plants a page whose tag contains a SQL-breakout payload (the INSERT escapes it but stores the literal quote), makes the page non-orphaned via an {{include}} link, then triggers deletePage(), where the stored tag is concatenated unescaped into a DELETE FROM _links WHERE to_tag='$tag' query. A detailed proof-of-concept with confirmed time-based blind extraction exists; the flaw enables reading password hashes, ACLs, and private page bodies, acting as a low-priv-to-admin escalation primitive. No public evidence of active exploitation was identified at time of analysis.

Remote code execution in Metabase's H2 database driver allows an authenticated user with native-query privileges to run arbitrary Java on the server. When Metabase returns H2 result columns of type OTHER (JDBC JAVA_OBJECT), it deserializes the embedded Java object without validation, so a crafted native H2 query triggers CWE-502 unsafe deserialization and full server compromise. It affects any instance using an H2 connection, including the default bundled sample database. No public exploit is identified at time of analysis (SSVC exploitation: none; EPSS 0.45%), though the upstream fix commit and vendor advisory GHSA-w95f-x9v9-wv36 are public.

Improper input validation in the snap7 library (versions up to 1.4.3) allows adjacent-network attackers to trigger a deserialization flaw via crafted ReadVar requests processed by TS7Worker::PerformFunctionRead in the S7 server component. Exploitation results in partial confidentiality, integrity, and availability impact against the snap7 server process - a concern in industrial OT environments where PLC communication libraries may interface with safety-relevant systems. No vendor-released patch exists as the maintainer has not responded to disclosure, and a publicly available proof-of-concept exploit lowers the barrier to exploitation.

PHP object injection in the Appointment Booking Calendar and Scheduling Plugin for WordPress (all versions through 1.1.28) lets unauthenticated attackers pass attacker-controlled data into a PHP deserialization call, and where a suitable gadget chain exists on the site this can be escalated to remote code execution. Reported by WPScan with publicly available exploit detail, though EPSS is low (0.23%, 13th percentile) and CISA SSVC records no observed exploitation, so this is a proof-of-concept-grade risk rather than confirmed active exploitation. Impact is total (confidentiality, integrity, availability) when a gadget chain is present, but the high attack complexity reflects that dependency.

Remote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controlled class path is loaded via an unrestricted import_string() when the Scheduler or API Server deserializes the serialized DAG, executing arbitrary code in those privileged processes and breaking the core Airflow boundary that DAG-author code must never run in the Scheduler/API Server. Reported by Apache with a fix in 3.3.0, it currently has no public exploit identified and a low EPSS of 0.69% (48th percentile), and it is not listed in CISA KEV. The practical severity depends heavily on how much a deployment trusts its DAG authors, since exploitation requires the ability to submit a DAG.