Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2026-71513

NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Nltk
Products
Nltk
CVE-2026-18948

Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

CVSS 3.1 · 9.9 Critical EPSS 1.1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-78276

WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-40877

Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Combodo
Products
Itop
CVE-2026-78257

WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-53435

jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

CVSS 3.1 · 8.8 High EPSS 51.2% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Jenkins Jenkins
CVE-2026-76395

Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Ai Toolkit Splunk Ai Toolkit
CVE-2026-0551

PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Buildwps Wordpress
Products
Ppwp – Password Protect Pages Wordpress
CVE-2026-41586

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hyperledger
Products
Fabric
CVE-2020-11112

jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

CVSS 3.1 · 8.8 High EPSS 3.7% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 37 more
CVE-2020-35728

jackson-databind: mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

CVSS 3.1 · 8.1 High EPSS 12.5% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Service Level Manager and 39 more
CVE-2020-14061

jackson-databind: serialization in weblogic/oracle-aqjms

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

CVSS 3.1 · 8.1 High EPSS 4.5% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Active Iq Unified Manager and 17 more
CVE-2020-11113

jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 39 more
CVE-2020-11111

jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

CVSS 3.1 · 8.8 High EPSS 3.6% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 37 more
CVE-2016-8735

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

CVSS 3.1 · 9.8 Critical EPSS 90.3% KEV · Listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 16 more
CVE-2020-10673

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

CVSS 3.1 · 8.8 High EPSS 8.0% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 39 more
CVE-2020-10672

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Debian Fasterxml Netapp and 2 more
Products
Debian Linux Jackson-databind Steelstore Cloud Integrated Storage and 38 more