Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the camel-vertx-http component deserializing attacker-controlled Java objects without an ObjectInputFilter when transferException or allowJavaSerializedObject is enabled, which allows an attacker...

EUVD-2026-57828

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-2026-73583 Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-2026-73583

The CVE-2026-73583 issue affects the sblim-sfcb component and stems from unsafe deserialization in the provider-manager IPC message parsing. A local attacker with system access can send a crafted message to trigger out-of-bounds memory access, causing the provider-manager process to terminate (de...

CVE-2026-73583 Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-2026-73583

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-Apache-Ecosystem

Apache Ecosystem CVE Vulnerability Reproduction Testbed D...

WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

AVEVA Enterprise SCADA

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of...

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-73583: Out-of-bounds Read

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2026-71800

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description An insecure deserialization issue allows a low-privileged administrative user to cause a denial of service by consuming system resources. This occurs whe...

PT-2026-71796

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw allows a low-privileged authenticated user to submit a small request containing a forged opaque identifier. The system decodes and deserializes this identifier before verifying i...

PT-2026-71612

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-10571: Deserialization of Untrusted Data

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled...