5612 matches found
PT-2026-24898
A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization...
PT-2026-25037
Name of the Vulnerable Software and Affected Versions flatted versions prior to 3.4.0 Description flatted is a circular JSON parser. The parse function uses a recursive revive phase to resolve circular references in deserialized JSON. When provided with a crafted payload containing deeply nested ...
CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization...
Exploit for Deserialization of Untrusted Data in Kentico Xperience
CVE-2019-10...
Deserialization of Untrusted Data
Overview limesurvey/limesurvey is a FOSS online survey tool on the web. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the decodeTokenAttributes helper. An attacker can achieve remote code execution by supplying a malicious serialized token attribute...
EUVD-2026-10565
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file...
EUVD-2026-10566
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file...
EUVD-2025-208471
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization...
EUVD-2025-208504
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server...
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server...
CVE-2026-1286
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file...
CVE-2026-25166
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally...
CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization...
CVE-2025-11739
CVE-2025-11739 describes a CWE-502 Deserialization of Untrusted Data vulnerability that could allow arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream triggering unsafe deserialization. The description notes local attack vecto...
CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability list is as follows - CVE-2021-22054 CVSS score: 7.5 - A server-side request forgery...
CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server...
PT-2026-24258
Name of the Vulnerable Software and Affected Versions Versions prior to 2026-1286 Description A flaw exists due to the deserialization of untrusted data. This issue could result in a loss of confidentiality and integrity, and potentially allow for remote code execution on a workstation. The issue...
CVE-2025-56422
CVE-2025-56422 describes a remote-code-execution risk in LimeSurvey via a deserialization vulnerability . The affected line is for versions earlier than 6.15.0+250623 . The advisory notes that a remote attacker could execute arbitrary code on the server, but the provided documents do not include ...
PT-2026-24346
CVE-2025-56422 A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server. https://t.co/1iXRc3gZGI...