Directory Traversal

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Directory Traversal via untrusted attachment metadata fields id, name, and extension parsed from an imported archive in...

CVE-2026-32465: Deserialization of Untrusted Data

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-60392: Deserialization of Untrusted Data

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In PDF Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...

CVE-2026-73341: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-66620: Deserialization of Untrusted Data

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

Ghidra 12.1.3

Ghidra is a software reverse engineering SRE framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including...

CVE-2026-74012: Deserialization of Untrusted Data

Editor PHP Object Injection in TaxoPress = 3.51.0 versions...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-83382

Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algo from pickle was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released 2026-01-29. All three pickle.loads calls remain unchanged. The fix w...

CVE-2026-59940: Deserialization of Untrusted Data

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

CVE-2026-73380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

PT-2026-77043

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-60412: Deserialization of Untrusted Data

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Core. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology...

CVE-2026-73376: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

Ubuntu Security Notice USN-8642-1

Ubuntu Security Notice 8642-1 - It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service...

CVE-2026-73397: Deserialization of Untrusted Data

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73366: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-99465

Name of the Vulnerable Software and Affected Versions MONAI versions prior to 1.6.0 Description The NumpyReader class contains an unsafe deserialization issue. It unconditionally uses the numpy.load function with the allow pickle=True parameter when processing .npy and .npz files. This allows an...

CVE-2026-69146

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...