CVE Database

CVE-2026-104730 Critical · 9.8 CWE-502 Oct 16, 2026

Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.

CVE-2026-104932 High · 8.0 CWE-502 Oct 16, 2026

Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.

CVE-2026-75941 High · 8.0 CWE-502 Oct 15, 2026

Deserialization of Untrusted Data in Lenovo Legion Zone Application

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

CVE-2026-47218 Critical · 9.3 CWE-502 Oct 15, 2026

runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.

CVE-2026-111160 High · 7.5 CWE-502 Oct 15, 2026

LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.

CVE-2026-110874 Medium · 6.6 CWE-502 Oct 15, 2026

Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

CVE-2026-110812 Critical · 9.9 CWE-502 Oct 15, 2026

Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

CVE-2026-111094 Critical · 9.8 CWE-502 Oct 15, 2026

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist...

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

CVE-2026-47168 Critical · 9.1 CWE-502 Oct 15, 2026

EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do not restrict allowed classes, allowing attacker-controlled object instantiation and arbitrary code execution on the server. This issue is fixed in version 9.3.7.

CVE-2026-109686 Critical · 9.8 CWE-502 Oct 15, 2026

WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

CVE-2026-102469 Medium · 5.9 CWE-502 Oct 15, 2026

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...

In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call with no ObjectInputFilter or class allowlist. This code path is triggered when a DRDA server sends a result set with a column tagged as UDT (FDOCA protocol LID 0x50). However, DB2 does not support this type of UDT. The FDOCA 0x50 type is never sent by a legitimate DB2 server. Nevertheless, a malicious or man-in-the-middle DRDA server could craft a response with a 0x50-tagged column, causing the client to deserialize arbitrary attacker-controlled bytes on the Vert.x event loop before any application code can inspect or reject the data. If a Java deserialization gadget chain is present on the application's classpath, this enables remote code execution. Without a gadget chain, denial of service is possible via crafted object graphs. TLS is disabled by default, making man-in-the-middle exploitation feasible. The impacted component is io.vertx:vertx-db2-client.

CVE-2026-110761 High · 8.8 CWE-502 Oct 14, 2026

ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

CVE-2026-55573 Critical · 9.8 CWE-502 Oct 14, 2026

e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

CVE-2026-97278 High · 7.2 CWE-502 Oct 14, 2026

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.

CVE-2026-108291 Critical · 9.8 CWE-502 Oct 14, 2026

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

CVE-2026-106599 High · 8.8 CWE-502 Oct 14, 2026

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

CVE-2026-73793 High · 7.9 CWE-502 Oct 14, 2026

HPE NonStop Middleware - Secret key handling vulnerability

HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.

CVE-2026-104764 High · 7.2 CWE-502 Oct 14, 2026

Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVE-2026-93905 High · 8.2 CWE-502 Oct 13, 2026

IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

CVE-2026-65674 High · 8.8 CWE-502 Oct 13, 2026

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

CVE-2026-49950 Critical · 9.8 CWE-502 Oct 13, 2026

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

CVE-2026-105442 High · 7.5 CWE-502 Oct 13, 2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.

CVE-2026-96186 High · 7.8 CWE-502 Oct 13, 2026

Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

CVE-2026-88091 High · 7.8 CWE-502 Oct 13, 2026

Windows Management Instrumentation Elevation of Privilege Vulnerability

Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

CVE-2026-87697 High · 8.8 CWE-502 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.