Export limit exceeded: 425829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,935

Export CSV
CVE-2026-76595

advisor-backend: Unsafe YAML deserialization of associate-editable Task playbook (yaml.Loader)

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML (YAML Ain't Markup Language) with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted YAML input, leading to remote code execution (RCE) within the `advisor-backend` pod. This compromise could allow access to shared database credentials and impact all tenants.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Advisor-backend
Products
Advisor-backend
CVE-2026-55083

DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Dhis2
Products
Dhis2-core
CVE-2026-43642

Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Softaculous
Products
Virtualizor
CVE-2026-12256

WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Theme-fusion Wordpress
Products
Avada Wordpress
CVE-2026-58163

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Traffic Server Apache Traffic Server
CVE-2026-97284

WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-73699

FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Filerun
Products
Filerun
CVE-2026-47825

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Gateway Spring Cloud Gateway
CVE-2026-103395

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Modeltc
Products
Lightllm
CVE-2026-35502

Privilege Escalation via Untrusted Deserialization in Intel Extension for PyTorch

Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Extension For Pytorch Intel Extension For Pytorch
CVE-2026-101169

Authenticated Insecure Deserialization Enables Arbitrary Code Execution in Octopus Server

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Octopus
Products
Octopus Server
CVE-2026-100841

MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Project-monai
Products
Monai
CVE-2026-80428

ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

CVSS 4.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Vendors
Ilias
Products
Ilias
CVE-2026-102455

DigiWin｜EasyFlow .NET - Insecure Deserialization

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net