EUVD-2026-89482

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-13046

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...

CVE-2026-100512: Deserialization of Untrusted Data

Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...

PT-2026-103077

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Insecure Deserialization allows unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content. Deserialization is the proces...

CVE-2026-97256: Deserialization of Untrusted Data

Editor PHP Object Injection in Page Builder by SiteOrigin = 2.36.0 versions...

CVE-2026-102377: Deserialization of Untrusted Data

Contributor PHP Object Injection in Photo Gallery by 10Web = 1.8.46 versions...

CVE-2026-103441: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43...

CVE-2026-103395: Deserialization of Untrusted Data

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-96832: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-94683: Deserialization of Untrusted Data

Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...

CVE-2026-94678: Deserialization of Untrusted Data

Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...

CVE-2026-94122: Deserialization of Untrusted Data

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

CVE-2026-94121: Deserialization of Untrusted Data

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

CVE-2026-94076: Deserialization of Untrusted Data

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

CVE-2026-102455: Deserialization of Untrusted Data

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

PT-2026-103349

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43...

PT-2026-103539

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A deserialization weakness exists where crafted data can be deserialized unsafely, potentially leading to remote code execution on the appliance. Deserialization is the process of converting a...