Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

Microsoft Office Publisher Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-77092

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-77092 Content Extractor Privilege Escalation

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

CVE-2026-77092

Commvault Content Extractor contained a deserialization of untrusted data flaw affecting privilege management , enabling privilege escalation . The NVD-assigned CVSS 3.1 score is 9.8 (CRITICAL) with a network vector and no required privileges, while the CNA-assigned CVSS 4.0 score is 7.3 (HIGH) w...

EUVD-2026-72724

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

CVE-2026-77092 Content Extractor Privilege Escalation

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

Deserialization Of Untrusted Data

Spring Batch is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to DefaultExecutionContextSerializer passing Base64-decoded data directly to ObjectInputStream.readObject without an ObjectInputFilter, which allows an attacker to provide malicious serialized objects and...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

Adobe Experience Manager Forms - Insecure Deserialization

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

CVE-2026-71374

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

BIT-JENKINS-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

BIT-JENKINS-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...