Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IB...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363

CVE-2026-11363 affects the Ninja Forms WordPress plugin (all versions ≤ 3.14.6) with an authenticated PHP Object Injection vulnerability. During form import, WPN_Helper::build_nf_cache() calls $action-&gt;get_settings(), triggering deserialization of untrusted input with no further user interacti...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

EUVD-2026-74608

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

CVE-2026-87083

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87083

A flaw was found in tile-ai tilelang. This vulnerability, located in the Kernel Cache component's KernelCache.loadkernelfromdisk function, allows a remote attacker to perform deserialization. This could lead to various impacts, such as arbitrary code execution or information disclosure, by...

EUVD-2026-74538

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87083 tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87083

A deserialization vulnerability exists in tile-ai tilelang (up to version 0.1.14), affecting the function KernelCache._load_kernel_from_disk in the file tilelang/cache/kernel_cache.py (component: Kernel Cache). The flaw can be triggered remotely with low privileges and required user interaction, ...

CVE-2026-87083 tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87083 tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

PT-2026-88788

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

PT-2026-89110

MaxSite CMS through 109.6 passes the ci session cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achiev...

PT-2026-88759

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache. load kernel from disk of the file tilelang/cache/kernel cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. Th...

CVE-2026-87083: Deserialization of Untrusted Data

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-11363: Deserialization of Untrusted Data

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2023-54396: Improper Validation of Array Index

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...