PT-2025-27604 · WordPress · Education Theme

Name of the Vulnerable Software and Affected Versions: Education theme for WordPress versions up to, and including, 3.6.10 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the themerex callback view more posts function. This...

CVE-2025-32897

CVE-2025-32897 describes a deserialization of untrusted data vulnerability in Apache Seata (incubating) affecting versions 2.0.0 up to but not including 2.3.0. The underlying issue is unsafe deserialization of serialized user data, enabling potential code execution. The CVSS v3.1 base score is 9....

CVE-2025-32897 Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata incubating: from 2.0.0 before 2.3.0. Severity...

PT-2025-27321

Name of the Vulnerable Software and Affected Versions: Apache Seata incubating versions 2.0.0 through 2.3.0 Description: The issue is related to the deserialization of untrusted data. It is recommended that users upgrade to a fixed version to resolve the issue. Recommendations: For Apache Seata...

PT-2025-27120 · Unknown · Pebas Couponxl

Name of the Vulnerable Software and Affected Versions: pebas CouponXxL versions 3.0.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 3.0.0 and earlier, update to a version that fixes this issue, as n...

PT-2025-27276 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: The issue concerns a deserialization of untrusted data remote code execution vulnerability in the readObjectFromConfigFile function. This allows for remote code execution...

PT-2025-27138 · Unknown · Uxper Sala

Name of the Vulnerable Software and Affected Versions: uxper Sala versions 1.1.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 1.1.3 and earlier, update to a version that fixes this issue, however a...

CVE-2025-47771

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

CVE-2025-47771

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

CVE-2025-47771

PowSyBl Core versions 6.3.0–6.7.1 contain a deserialization issue in SparseMatrix.read(InputStream) that can lead to privilege escalations under various circumstances. The root cause is a vulnerability in how SparseMatrix is deserialized, enabling untrusted input to affect system state. A fix is ...

CVE-2025-47771 PowSyBl Core allows deserialization of untrusted SparseMatrix data

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

CVE-2025-47771 PowSyBl Core allows deserialization of untrusted SparseMatrix data

PowSyBl Power System Blocks is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in...

PowSyBl Core allows deserialization of untrusted SparseMatrix data

Impact What kind of vulnerability is it? Who is impacted? This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the re...

PT-2025-25632 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A deserialization issue is mentioned, but details are not provided. No information is available about the estimated number of potentially affected devices or real-world incidents...

CVE-2025-24919

A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 and ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault response to a command can lead to arbitrary code execution. An attacker can...

Security Bulletin: A vulnerability in Apache Active MQ NMS affects IBM Robotic Process Automation and could result in arbitrary code exections (CVE-2025-29953).

Summary A vulnerability in Apache Active MQ NMS affects IBM Robotic Process Automation and could result in arbitrary code exections CVE-2025-29953. Apache Active MQ is used by IBM Robotic Process automation for integration with Apache Active MQ. This security bulletin identifies the fixes require...

Apache InLong Deserialization Vulnerability (CNVD-2025-12411)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong versions 1.13.0 to 2.1.0 has a deserialization vulnerability , the vulnerability stems from the application in the...

CVE-2025-31398

CVE-2025-31398 describes a deserialization of untrusted data vulnerability in the WordPress theme “PIMP – Creative MultiPurpose” (

CVE-2025-31396 WordPress FLAP - Business WordPress Theme <= 1.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5...

Apache InLong Deserialization of Untrusted Data Vulnerability

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the...