SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE

SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass CVE-2025-40536, remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to...

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

CVE-2026-114403

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

EUVD-2026-107250

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

CVE-2026-113356

A flaw was found in DokuWiki. An authenticated remote attacker with page edit permissions can exploit a timing flaw race condition during draft saves to inject malicious data into draft files. Because the application processes this stored draft content through insecure object deserialization...

CVE-2026-113404

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

EUVD-2026-104808

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

CVE-2026-113404

The software WebITR , developed by Uniong , contains an Insecure Deserialization vulnerability (CWE-502). Authenticated remote attackers can exploit this by utilizing a hard-coded cryptographic key to craft and submit malicious serialized data. Successful exploitation allows the attacker to achie...

CVE-2026-113404 Uniong｜WebITR - Insecure Deserialization

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

CVE-2022-44877-RCE

This repository does not have a README...

CVE-2026-83520

A flaw was found in .NET. An insecure deserialization vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution over a network. By convincing an application or user to process specially crafted serialized data, an attacker can execute malicious commands with the...

CVE-2026-70035

A flaw was found in .NET. The vulnerability stems from insecure deserialization, where data transmitted over a network is reconstructed without adequate validation. A remote, unauthenticated attacker could exploit this issue by convincing a user to process specially crafted input. Successful...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84064 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special...

CVE-2026-102469

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x DB2 client vertx-db2-client contains DRDA protocol handling code that deserializes User Defined Type UDT column data using a bare ObjectInputStream.readObject call with no ObjectInputFilter or clas...

PT-2026-114957

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.7 Description An authenticated administrator can provide crafted serialized PHP object data stored in background MassAction or Export parameters. The application later deserializes this data without restricting...

CVE-2026-105442

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service...

CVE-2026-109361

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...

CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...

EUVD-2026-97663

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...

CVE-2026-109361

The MONAI library (versions 1.2.0 before 1.6.1 ) is vulnerable to an insecure deserialization vulnerability within the nnUNetV2Runner component. The root cause is that the software unpickles the postprocessing_file path retrieved from inference_information.json without restricting it to the resul...