Base de CVEs

CVE-2026-3245 Alta · 7.5 CWE-502 02/08/2026

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to...

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

CVE-2026-16062 Média · 6.6 CWE-502 02/08/2026

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-injection advisories.

CVE-2026-68771 Crítica · 9.8 CWE-502 31/07/2026

ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

CVE-2026-12720 Alta · 7.5 CWE-502 31/07/2026

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress version), this could be leveraged to perform a variety of attacks, such as remote code execution.

CVE-2026-11536 Alta · 8.5 CWE-502 30/07/2026

IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

CVE-2026-15976 Crítica · 9.8 CWE-502 30/07/2026

CVE-2026-15976

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

CVE-2026-15969 Crítica · 9.8 CWE-502 30/07/2026

CVE-2026-15969

SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

CVE-2026-12118 Crítica · 9.8 CWE-502 30/07/2026

IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-57859 Alta · 7.5 CWE-502 30/07/2026

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().

CVE-2026-1360 Alta · 7.5 CWE-502 30/07/2026

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

CVE-2026-65883 Crítica · 9.8 CWE-502 29/07/2026

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

CVE-2026-58163 Crítica · 9.1 CWE-502 29/07/2026

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVE-2026-14974 Crítica · 9.8 CWE-502 28/07/2026

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

CVE-2026-14512 Crítica · 9.8 CWE-502 28/07/2026

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

CVE-2026-66713 Crítica · 9.8 CWE-502 28/07/2026

Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code via a crafted serialized Java object delivered to the cluster channel and deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are recommended to upgrade to version 2.0.1, which fixes this issue by removing the clustering feature entirely.

CVE-2026-11756 Crítica · 10.0 CWE-502 28/07/2026

Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

CVE-2026-65617 Alta · 8.8 CWE-502 27/07/2026

Potential remote code execution on an Artifactory package service container.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

CVE-2026-63077 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-502 27/07/2026

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

CVE-2026-15962 Alta · 8.8 CWE-502 25/07/2026

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.

CVE-2026-50517 Crítica · 9.9 CWE-502 23/07/2026

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

CVE-2026-21655 Alta · 8.7 CWE-502 23/07/2026

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

CVE-2026-65497 Alta · 7.2 CWE-502 23/07/2026

WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

CVE-2026-65493 Alta · 7.5 CWE-502 23/07/2026

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

CVE-2026-59544 Crítica · 9.8 CWE-502 23/07/2026

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

CVE-2026-13190 Alta · 8.1 CWE-502 22/07/2026

PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.