37411 matches found
PT-2026-79214
Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An issue exists in the cloud identity platform where the deserialization of untrusted data allows an unauthorized remote attacker to execute arbitrary code over the network. This...
PT-2026-78953
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
PT-2026-78976
Name of the Vulnerable Software and Affected Versions Flatastic versions prior to 2.1 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objects and...
PT-2026-79266
A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...
CVE-2026-18285: Deserialization of Untrusted Data
Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization. An attacker can execute arbitrary code or manipulate application behavior by supplying specially crafted input that is deserialized without proper validation. Details Serializati...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted jsonTypeId message header that is mapped from an external source, such as...
CVE-2026-73993: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-15679: Deserialization of Untrusted Data
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...
CVE-2026-69836: Deserialization of Untrusted Data
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SerializingHttpMessageConverter process. An attacker can execute arbitrary code by sending a specially crafted HTTP request with the Content-Type set to application/x-java-serialized-object and a...
VulnCheck KEV: CVE-2021-23758
Ajax.NET Professional AjaxPro contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a...
CVE-2026-77646: Deserialization of Untrusted Data
A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...
Deserialization of Untrusted Data
Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialize function. An attacker can execute arbitrary code or...
Deserialization of Untrusted Data
Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the springjsonheadertypes message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a craft...
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the jsonTypeId message header to an arbitrary class without an allow-list...
Deserialization of Untrusted Data
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...