Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,745

Export CSV
CVE-2026-11536

IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-12118

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Webmethods Integration Webmethods Integration On Prem
CVE-2026-24232

Improper Deserialization in NVIDIA Transformers4Rec Enables Code Execution

NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Transformers4rec
CVE-2026-1360

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Buddypress Wordpress
Products
Buddypress Wordpress
CVE-2026-32590

Mirror-registry: remote code execution using pickle deserialization

A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a format that, if tampered with, could allow an attacker to execute arbitrary code on the Quay server.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Mirror Registry Mirror Registry For Red Hat Openshift Quay
CVE-2026-65883

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Aimy-extensions Aimy-extensions.com
Products
Aimy Captcha-less Form Guard Aimy Captcha-less Form Guard Plugin For Joomla
CVE-2026-14974

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-14512

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-11756

Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Dassault Systèmes
Products
Station Launcher App In 3dexperience Platform
CVE-2026-13185

PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Ajax
CVE-2026-53666

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Remix-run Shopify
Products
React-router React-router
CVE-2026-65617

Potential remote code execution on an Artifactory package service container.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-25873

OmniGen2-RL Reward Server Unsafe Deserialization RCE

OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service.

CVSS 4.0 · 9.3 Critical EPSS 1.3% KEV · Not listed
Vendors
Beijing Academy Of Artificial Intelligence Cisco
Products
Omnigen2-rl Intelligence Proximity
CVE-2025-66571

UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection

UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Una Unacms
Products
Una Una
CVE-2021-47952

python jsonpickle 2.0.0 Remote Code Execution via py/repr

python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute arbitrary code.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jsonpickle Project
Products
Jsonpickle
CVE-2026-15962

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Techjewel Wordpress
Products
Fluent Forms Pro Add On Pack Wordpress
CVE-2026-13190

PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Ajax
CVE-2026-58233

Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and extract sensitive information and gain control over the system and its processes. This vulnerability has a high impact on confidentiality and integrity of the data, with a low impact on the availability of the system.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Change And Transport System Attach Tool (ctsattach)
CVE-2026-45077

Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Sensiolabs Symfony
Products
Symfony Monolog-bridge Symfony
CVE-2026-50517

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot