37393 matches found
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted jsonTypeId message header that is mapped from an external source, such as...
PT-2026-78976
Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...
PT-2026-79266
A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...
cve-2026-59307 - HIGH - Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
cve-2026-59307 - HIGH - Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference...
CVE-2026-18285: Deserialization of Untrusted Data
Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization. An attacker can execute arbitrary code or manipulate application behavior by supplying specially crafted input that is deserialized without proper validation. Details Serializati...
CVE-2026-73993: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-15679: Deserialization of Untrusted Data
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...
CVE-2026-69836: Deserialization of Untrusted Data
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...
PT-2026-79265
Name of the Vulnerable Software and Affected Versions PTC Windchill affected versions not specified PTC FlexPLM affected versions not specified Description A critical remote code execution RCE issue exists in PTC Windchill and PTC FlexPLM. This flaw allows for the execution of arbitrary code...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SerializingHttpMessageConverter process. An attacker can execute arbitrary code by sending a specially crafted HTTP request with the Content-Type set to application/x-java-serialized-object and a...
VulnCheck KEV: CVE-2021-23758
Ajax.NET Professional AjaxPro contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the setBeanClassLoader process. An attacker can execute arbitrary code by injecting malicious serialized data into the INTMESSAGE.MESSAGECONTENT field. This is only exploitable if the deserializatio...
CVE-2026-77646: Deserialization of Untrusted Data
A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the jsonTypeId message header to an arbitrary class without an allow-list...
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution...
Deserialization of Untrusted Data
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...