Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,744

Export CSV
CVE-2026-126322

OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php

OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patient_match_dialog.php to enumerate patients or force matches that associate lab orders with the wrong patient.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-128083

Laravel: Task Output Injection - Concurrency Process

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled bytes at the start of the child's standard output that form a complete JSON document followed by gzip magic bytes. Under those application-specific conditions, an attacker can forge the internal result message and achieve remote code execution. The affected behavior is not exposed by default and requires application code that routes untrusted input into task output. This issue is fixed in versions 12.71.0 and 13.40.0.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-63079

RBH Integra32 5.1.11 .NET Remoting Deserialization RCE

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-119512

WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-120835

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-125855

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

CVSS 3.1 · 9.8 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-103769

WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.

CVSS 3.1 · 7.2 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-82845

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Masteriyo Lms
CVE-2026-84099

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpstorecart
CVE-2025-71463

Scapy before 2.7.0 Insecure Deserialization RCE via Session Files

Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__().

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Scapy
Products
Scapy
CVE-2026-119077

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59081

Deserialization of untrusted data in Edito CMS

Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126982

Remote code execution via generic-type allow-list bypass in BSON object deserialization

A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later deserializes can cause the application process to instantiate .NET types outside the intended allow-list and populate them with unauthorized party-controlled values. In applications that contain a suitable gadget type, this can lead to arbitrary code execution in the context of the application, with corresponding loss of confidentiality, integrity, and availability. No special privileges beyond the ability to introduce data the application reads are required.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126839

Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-77882

Local Privilege Escalation via Untrusted Deserialization in Lenovo System Update

A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
System Update
CVE-2026-10859

IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Mq