CVE-2026-103441: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43...

CVE-2026-103395: Deserialization of Untrusted Data

LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...

CVE-2026-96832: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Content Egg = 6.3.1 versions...

CVE-2026-96831: Deserialization of Untrusted Data

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-94683: Deserialization of Untrusted Data

Contributor PHP Object Injection in DesignSetGo = 2.8.0 versions...

CVE-2026-94678: Deserialization of Untrusted Data

Contributor PHP Object Injection in Go Live Update Urls = 7.0.8 versions...

CVE-2026-94122: Deserialization of Untrusted Data

Editor PHP Object Injection in Responsive Slider Gallery = 1.5.5 versions...

CVE-2026-94121: Deserialization of Untrusted Data

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer = 2.33.6 versions...

CVE-2026-94076: Deserialization of Untrusted Data

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93624: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Music Player for WooCommerce = 1.9.1 versions...

PT-2026-103349

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43...

PT-2026-103539

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A deserialization weakness exists where crafted data can be deserialized unsafely, potentially leading to remote code execution on the appliance. Deserialization is the process of converting a...

PT-2026-103077

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Insecure Deserialization allows unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content. Deserialization is the proces...

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784562620)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784562620 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2025:1760984077)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760984077 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an...

CVE-2026-96833: Deserialization of Untrusted Data

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784562620)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784562620 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0...

CVE-2026-102455: Deserialization of Untrusted Data

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CentOS Linux 7 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS7:CLSA-2023:1697135256)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1697135256 advisory. - A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial...