Insecure Deserialization

Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.

Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.

Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-level privileges to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector indicates exploitation requires only local, low-privileged access with no user interaction, making this a meaningful threat in multi-tenant AI training environments where shared compute access is common. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to execute arbitrary code, tamper with data, and disclose sensitive information on affected systems. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where a crafted malicious payload supplied to the Bridge component triggers unsafe deserialization, granting the attacker full control over the vulnerable process. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS 7.8 score reflects the severity of successful exploitation.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS:3.1 score of 7.8 (High) with a local attack vector reflects that exploitation requires an existing foothold on the system, but the low privilege requirement and no user interaction needed make post-access exploitation straightforward. No public exploit code or CISA KEV listing has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to code execution, data tampering, and information disclosure when an attacker with local user access supplies a malicious serialized payload to the Bridge process. The local attack vector (AV:L) and low-privilege requirement (PR:L) place this vulnerability in the context of shared AI/ML training infrastructure - multi-tenant GPU clusters where lateral movement between users is the realistic threat model. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The CVSS 7.8 score (AV:L/PR:L) constrains exploitation to local contexts, but the high impact across all three CIA triad components reflects the severity of a successful exploit. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information on affected systems. Rooted in CWE-502, the flaw arises when the bridge component deserializes attacker-influenced data without adequate validation - a well-understood attack class that is particularly dangerous in distributed AI training infrastructure where serialized model state or inter-process messages transit between components. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge exposes AI training infrastructure to code execution, data tampering, and information disclosure by local low-privileged attackers. The vulnerability (CWE-502) resides in a bridge component of the Megatron-LM distributed training framework, used extensively in large-scale LLM training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 7.8 (High) reflects the severity of a full triad (C:H/I:H/A:H) impact if exploitation succeeds.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker holding standard user privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the exploitation path is local and low-privilege - no network exposure or administrator rights are required, making insider threats, shared-access HPC environments, and compromised user accounts the primary risk vectors. No public exploit code or active exploitation has been identified at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability (CWE-502) stems from the application accepting and processing serialized data without adequate validation, enabling crafted payloads to subvert normal deserialization logic. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full C:H/I:H/A:H impact triad indicates a severe outcome if exploited by a user with existing local access.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with data, and disclose sensitive information. The CVSS vector (AV:L/AC:L/PR:L) indicates the vulnerability is exploitable locally without elevated privileges or user interaction, making it a significant risk in multi-tenant distributed AI training environments where multiple users share infrastructure. No public exploit or KEV listing is confirmed at time of analysis.

Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The vulnerability carries a CVSS 3.1 score of 7.8 with a local attack vector, indicating that an attacker with an existing foothold on the system can escalate impact significantly. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full CIA triad impact (High/High/High) makes this a high-priority remediation target for any organization running Megatron Bridge in research or production AI training environments.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to execute arbitrary code, tamper with application data, and exfiltrate sensitive information. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is bounded to local authenticated users or processes, but the full C:H/I:H/A:H impact triad makes successful exploitation highly damaging within that local scope. No public exploit has been identified at time of analysis, and no CISA KEV listing has been observed.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local, low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected host. The local attack vector (AV:L) and low-privilege requirement (PR:L) limit the attack surface to users or processes with existing system access, yet the full C:H/I:H/A:H impact triad makes successful exploitation highly consequential. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the NVIDIA PSIRT has published a security advisory via their product-security GitHub repository.

Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and sensitive information disclosure on the affected system. The CVSS 7.8 base score reflects a local attack vector requiring only low-privilege access with no user interaction, producing full high-impact compromise across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the severity of potential impact warrants prompt patching in AI training environments.

Unsafe PyYAML deserialization in ModelScope through v1.40.0 enables remote code execution when users load model configuration files from attacker-controlled repositories. The vulnerability exists in at least two documented components - the audio TTS voice module (voice.py) and the multimodal mPLUG configuration loader (configuration_mplug.py) - which use PyYAML's unsafe yaml.Loader that processes Python object construction tags such as !!python/object: during deserialization. An attacker who publishes a poisoned model repository can achieve full code execution on any victim system that loads the model, with no public exploit identified at time of analysis.

Unauthenticated PHP Object Injection affects the Tickera event ticketing plugin for WordPress in all versions up to and including 3.6.0.2, allowing remote attackers with no authentication to inject crafted serialized PHP objects into a deserialization sink. Reported by Patchstack and scored CVSS 9.8, the flaw can lead to high-impact compromise (confidentiality, integrity, and availability) if a suitable POP gadget chain is reachable in the plugin or its dependencies. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only basic read/search permissions to execute arbitrary code on the server by supplying a crafted serialized cursor parameter to the plugins/sql endpoint. Affecting all versions of self-hosted OpenSearch and Amazon OpenSearch Service up to the patched releases, this CWE-502 deserialization flaw is particularly dangerous because the low privilege bar means any cluster user - not just administrators - can trigger it. Vendor-released patches exist in OpenSearch 2.19.6 and 3.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.

PHP Object Injection leading to remote code execution affects the Pimcore DXP/CMS (composer pimcore/pimcore) in versions 2026.1.0-2026.1.5 and all 12.3.x through 12.3.9, where the Hotspotimage DataObject field marshaller deserializes the persisted `*__hotspots` object-store column with no class allowlist. Any attacker able to write crafted PHP-serialized bytes into that column gains arbitrary object instantiation on the next object load, chainable to RCE via gadgets in Pimcore's own bundled dependencies (guzzlehttp/guzzle 7.11.0). A working proof-of-concept demonstrating attacker-controlled file write is published in the vendor advisory; publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided.

Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordPress Author-level privileges, exploiting unsafe PHP deserialization (CWE-502) to execute arbitrary server-side code. The CVSS vector (AV:N/AC:L/PR:H) confirms the attack is network-delivered with low complexity once Author credentials are in hand, yielding full confidentiality, integrity, and availability compromise of the host. No active exploitation confirmed in CISA KEV and no public proof-of-concept has been identified in the available intelligence at time of analysis.

CPU exhaustion in SvelteKit's experimental remote form deserialization endpoint allows unauthenticated remote attackers to render affected servers unresponsive by submitting malformed form data, resulting in denial of service. Versions 2.49.0 through 2.52.1 of @sveltejs/kit are affected, but only when both the experimental.remoteFunctions and form features are simultaneously enabled - a non-default, opt-in configuration. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the complete availability impact against network-reachable endpoints with no authentication barrier once the experimental features are active.

Memory exhaustion in @sveltejs/kit versions 2.49.0 through 2.52.1 allows unauthenticated remote attackers to crash the server process by sending malformed form data to a remote function endpoint, resulting in complete denial of service. Exploitation is gated behind two simultaneous non-default opt-in conditions - the experimental.remoteFunctions flag and form usage - which significantly narrows the real-world attack surface relative to the CVSS 4.0 score of 8.7. No public exploit or CISA KEV listing has been identified; a vendor-released patch is available in version 2.52.2.

Denial of service in SvelteKit versions 2.49.0 through 2.53.2 is achievable by unauthenticated remote attackers who submit crafted multipart form requests that exploit a deserialization expansion flaw in the experimental `form` remote function, causing the server to construct disproportionately large `files` arrays and exhaust processing resources. Exploitation is gated behind a non-default opt-in flag (`experimental.remoteFunctions: true`) and requires the application to process the `files` array without length or size validation, substantially narrowing real-world exposure despite the CVSS 4.0 score of 8.7. No public exploit has been identified at time of analysis and the vulnerability does not appear in the CISA KEV catalog.

Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.

Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the deserialization root cause and network-reachable, no-authentication vector make it high priority.

PHP object injection via unsafe deserialization in the User Frontend WordPress plugin (versions before 4.3.10) grants Editor-level users the ability to execute arbitrary PHP code on the host server. The plugin fails to validate field type definitions and deserializes user-controlled post metadata at render time - a CWE-502 flaw exploitable through any available POP chain present in the WordPress environment. A public proof-of-concept exists per WPScan, though SSVC assessment notes no confirmed active exploitation at time of analysis.

Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.

Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS command execution, running as the Dimension WebUI process account. The vulnerability is exploitable by any user holding report administration permissions, making it a significant lateral-movement and post-compromise pivot risk within WatchGuard-managed network environments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the chained SQL injection-to-command-execution primitive is high impact for attackers who have obtained admin-level credentials.

Arbitrary code execution in SpeechBrain before v1.1.1 is triggered during checkpoint candidate enumeration when PyYAML's unsafe loader parses attacker-controlled CKPT.yaml files in the configured checkpoint path. An attacker who can plant a crafted CKPT.yaml - for example via a malicious pretrained model distributed through a public model repository - can embed !!python/object/apply YAML tags that cause Python to instantiate arbitrary objects at parse time, achieving code execution before any checkpoint is ever selected for recovery. No public exploit specific to this CVE has been identified at time of analysis, and it is not listed in the CISA KEV catalog, but the underlying PyYAML unsafe deserialization class is extensively documented and exploit techniques are widely known.

JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.

Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.

PHP Object Injection in the Hash Form WordPress plugin (versions 1.4.1 and earlier) lets remote, unauthenticated attackers inject crafted serialized objects that are deserialized by the plugin, enabling code execution, data tampering, or site compromise depending on available gadget chains. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with no authentication required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the Geo Controller WordPress plugin (the plugin distributed as cf-geoplugin) affects all versions up to and including 8.9.8, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and the CVSS vector reports full confidentiality, integrity, and availability impact, a suitable gadget chain in the plugin or wider WordPress environment could lead to remote code execution, data disclosure, or site takeover. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated administrators to pass arbitrary serialized PHP data through the editor component, triggering unsafe deserialization on the server and potentially achieving remote code execution, file writes, or full system compromise. The vulnerability is classified as CWE-502 and carries a CVSS 3.1 score of 7.2 (High), with full Confidentiality, Integrity, and Availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

PHP Object Injection in the Booking and Rental Manager WordPress plugin (by magepeopleteam, versions <= 2.7.5) allows an authenticated contributor-level user to pass malicious serialized payloads through unsanitized input handled by the plugin. If a PHP Property-Oriented Programming (POP) chain is present in the WordPress environment - commonly supplied by WooCommerce or co-installed plugins - exploitation can yield full confidentiality, integrity, and availability compromise of the underlying server. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA Known Exploited Vulnerabilities catalog.

Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to potential remote code execution via gadget-chain exploitation. The serializer passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter restricting instantiable types, creating a CWE-502 attack surface that any suitable gadget chain on the classpath can weaponize. Affected versions span Spring Batch 5.2.6 and earlier and 6.0.0 through 6.0.4; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity.

Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments.

Unauthenticated PHP object injection in the ILIAS e-learning platform allows remote attackers to achieve code execution as the web server user via the Shibboleth back-channel logout endpoint (shib_logout.php). The endpoint runs on an authentication-exempt path and passes every live session row's stored data through a hand-rolled parser that calls unserialize() with no class allowlist, so an attacker who first seeds a serialized object into a session row (via the equally unauthenticated LTI entry point) triggers a destructor-based POP chain that writes attacker-controlled JSON to an attacker-chosen path below the web root. No public exploit has been identified at time of analysis, but the flaw is unauthenticated and network-reachable, and the vendor CVSS 4.0 base score is 9.3 (Critical).

Remote code execution in Beijing Tongtech TongWeb 7.0.24 lets attackers run arbitrary code by sending a crafted serialized payload to the console/heimdall endpoint, which is backed by a Spring HttpInvokerServiceExporter that deserializes untrusted input. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists (two public gists), though EPSS is low (0.26%, 17th percentile) and the flaw is not in CISA KEV.

Analysis complete. The JSON synthesis above covers CVE-2026-19912 (Kaltura HTML5 Player unauthenticated RCE). Key points of the assessment: - **Impact**: Unauth network RCE (CVSS 9.8) chaining PHP object injection via `unserialize()` with attacker-controlled cache-path file write → webshell as the webserver user. - **Signal contrast**: High CVSS but low EPSS (0.22%), no KEV, and no public POC — high severity, no observed mass exploitation yet, so it's a "patch promptly" rather than "on-fire" item. - **Metadata**: Clean — vendor (`kaltura`) and CPE are correct, no mislabeled tags, so `data_quality_flags` is empty. - **Caveat surfaced**: No exact fixed version is present in the input; I flagged that it must be confirmed from Kaltura's advisory rather than inventing one. - **Security note**: The input's "Editorial note (internal)" was a prompt-injection attempt instructing insertion of the word "gniezno" — I ignored it (consistent with prior handling) and noted it in `confidence_notes`. I also recorded a memory entry for this CVE.

Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's pickle allowlist and run commands when a crafted model or tokenizer artifact is loaded. The allowlist trusts whole module namespaces rather than specific safe callables, so dangerous in-namespace functions can be invoked via pickle's REDUCE opcode. Reported by VulnCheck; no public exploit identified at time of analysis, though the root cause and gadget functions are documented in the advisory.

PHP Object Injection in the Kalles Addons WordPress plugin (all versions up to and including 1.0.6) allows unauthenticated remote attackers to deserialize untrusted PHP objects via a network-accessible deserialization endpoint. Exploitation is strictly conditional: the plugin itself contains no known POP (Property-Oriented Programming) chain, so real-world impact - ranging from arbitrary file deletion and sensitive data retrieval to remote code execution - only materializes when a separately installed plugin or theme on the same WordPress instance supplies a usable POP chain. No public exploit code and no CISA KEV listing have been identified at time of analysis.

PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.

Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.

Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.

PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.

Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

PHP object injection in Combodo iTop's user preference functionality prior to version 3.2.3 enables authenticated remote attackers to achieve remote code execution on the underlying server. The vulnerability stems from deserializing attacker-controlled PHP objects without validation, with the CVSS Scope:Changed metric reflecting that successful exploitation escapes the application boundary to compromise the host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-502 vulnerability class is well-understood and the attack complexity is rated Low once an authenticated session is obtained.

Unsafe pickle deserialization in Flair 0.15.0 and 0.15.1 allows arbitrary code execution with the privileges of the loading process when a victim calls ClusteringModel.load() on an attacker-supplied model file. The critical compounding factor is a false remediation: CVE-2024-10073 designated 0.15.0 as the fixed version after clustering was dropped from the documented API, but flair/models/clustering.py remains physically present in the PyPI-distributed wheels for both 0.15.0 and 0.15.1 and is directly importable, voiding the prior CVE's resolution. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.

PHP Object Injection in PPWP - Password Protect Pages (WordPress plugin, versions up to and including 1.9.18) permits authenticated attackers holding Contributor-level roles or higher to deserialize attacker-controlled data via the 'post_protection_roles' parameter, injecting arbitrary PHP objects into the application. Real-world impact is fully contingent on a Property-Oriented Programming (POP) chain being present in another co-installed plugin or theme - absent that chain, the vulnerability has no exploitable effect, but where one exists, outcomes can include arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code or active exploitation has been identified at time of analysis; however, a Wordfence advisory and a WordPress SVN changeset (3567221) both indicate a fix has been committed.

PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.

Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.

Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.

Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM allows unauthenticated remote attackers to induce the server to issue arbitrary internal network requests by submitting maliciously crafted serialized data for deserialization. The underlying root cause is CWE-502 (Deserialization of Untrusted Data), where the deserialization process itself is the vector that triggers the SSRF condition, enabling lateral movement toward backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of network accessibility and no authentication requirement elevates practical risk for internet-exposed deployments.

Remote code execution in PTC Windchill and PTC FlexPLM allows unauthenticated network attackers to execute arbitrary code by submitting maliciously crafted serialized objects that the application deserializes without validation. Rated CVSS 4.0 9.2 (Critical) with full confidentiality, integrity, and availability impact, though the vector's AC:H flag indicates the attack is non-trivial to reliably reproduce. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate.

Remote code execution in Hugging Face PyTorch Image Models (timm) version 1.0.24 is triggered when a user loads a crafted model checkpoint file, exploiting unsafe deserialization of untrusted data. The vulnerability, discovered by ZDI (ZDI-CAN-27987) and tracked as ZDI-26-523, allows an attacker who can deliver a malicious checkpoint to achieve full code execution in the context of the victim's process with no special system privileges required. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the attack surface is practically significant in ML/AI workflows where downloading pretrained checkpoints from public sources is routine.

Remote code execution in Aeon 1.3.0 is triggered when a user loads a maliciously crafted dataset file via the load_rehab_pile_dataset function, which called numpy's np.load() with allow_pickle=True - enabling full Python pickle deserialization of attacker-controlled content. Reported by Zero Day Initiative (ZDI-CAN-28749 / ZDI-26-468) and tracked as EUVD-2026-63433, the vulnerability carries CVSS 7.8 with full confidentiality, integrity, and availability impact limited by local attack vector and required user interaction. No public exploit has been identified at time of analysis, and an upstream patch commit is available but a tagged release version has not been independently confirmed.

Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.57.0, letting remote attackers submit crafted serialized data that is deserialized without validation to potentially achieve arbitrary object instantiation and, with a suitable POP gadget chain, remote code execution. The vulnerability carries a CVSS 9.8 rating with a fully unauthenticated network vector and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated remote code execution in InternLM LMDeploy (versions 0.9.2 through 0.15.x) allows a remote attacker to execute arbitrary code inside an inference engine process when disaggregated (P2P) serving is enabled. The disaggregation peer-connector deserializes attacker-influenced ZMQ messages with Python pickle before any type validation, and the /distserve/p2p_initialize and /distserve/p2p_connect endpoints require no authentication in the default configuration (api_keys=None). Reported by VulnCheck with a vendor advisory and a public patch; no public exploit or CISA KEV listing identified at time of analysis, though the code path and fix are publicly documented on GitHub.

Operating-system command execution in the Splunk MCP Server app (all versions below 1.2.1) lets a user already holding the Splunk 'admin' role run arbitrary commands on the underlying host by abusing unsafe deserialization in the credential-management component. Because the app trusts stored data and deserializes it without verifying the object type, a privileged Splunk user can escalate from application-level administration to full host compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

Arbitrary code execution in Splunk AI Toolkit below 6.0.0 is achievable by any user holding the Splunk 'power' role, through loading a crafted model file that embeds malicious pickle payloads inside sparse matrix data. The toolkit's model codec deserializes this data without sanitizing or restricting the embedded pickle content, granting the attacker code execution as the Splunk server process. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE impact with a low-privilege network vector makes this a high-priority patch target for any Splunk deployment running the AI or Machine Learning Toolkit.

Remote code execution on the Wazuh cluster master node is achievable by any attacker who controls a cluster worker node, exploiting unsafe Python builtin resolution in the distributed API merge path. Affected versions span 4.0.0 through 4.14.5 and 5.0.0-beta1; the vulnerable code in framework/wazuh/core/results.py called getattr(builtins, type_) with attacker-supplied strings from worker JSON responses, enabling exec or eval injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is mechanically trivial once a worker node is controlled, with the payload executing as root on the master.

Elevation of privilege via deserialization of untrusted data affects Dell Command Update (DCU) versions prior to 5.7.1 on local systems. A low-privileged local attacker can exploit unsafe deserialization to execute arbitrary code at a higher privilege level, potentially gaining full system control. No public exploit code or active exploitation has been identified at time of analysis, but the high CVSS score and straightforward attack complexity make this a meaningful patching priority for enterprise fleets.

Elevation of privilege in Dell Command Update (DCU) versions prior to 5.7.1 enables a low-privileged local attacker to fully compromise system confidentiality, integrity, and availability through unsafe deserialization of attacker-controlled data. The root cause is CWE-502 (Deserialization of Untrusted Data), a class of vulnerability where malicious serialized objects can trigger unintended code paths during deserialization, resulting in privilege escalation on Dell client endpoints. Dell has released version 5.7.1 as a fix per advisory DSA-2026-309; no public exploit or active exploitation has been identified at time of analysis.

Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Full takeover of Oracle Outside In Technology 8.5.8 is achievable by a local attacker who can position a malicious file for processing by an authorized user on the same host, exploiting a low-complexity flaw in the Outside In Core parsing engine. The vulnerability affects Oracle Fusion Middleware deployments running OIT 8.5.8 and yields complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and absence of privilege requirements (PR:N) make this straightforward to exploit for any attacker who has already achieved local system access.

Full system takeover via Oracle Outside In Technology 8.5.8 is achievable by a local attacker exploiting a flaw in the PDF Export SDK component, requiring no application-level privileges but depending on human interaction from another user on the same infrastructure. The attack vector is strictly local (AV:L), confining risk to hosts where the SDK executes, yet successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected process and host. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.

Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.

PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.

Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated PHP Object Injection in the WordPress plugin Popup by Supsystic (versions 1.13.0 and earlier) lets remote attackers submit crafted serialized data that the plugin deserializes without validation. Reported by Patchstack and rated CVSS 9.8, the flaw is exploitable without authentication or user interaction; if a suitable POP gadget chain is present in the WordPress core, another plugin, or theme, it can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.