CVE-2026-62912

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network...

CVE-2026-59124

Deserialization of untrusted data in Microsoft High Performance Computing HPC Pack allows an unauthorized attacker to execute code over a network...

CVE-2026-35502

Deserialization of untrusted data for some IntelR Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege...

EUVD-2026-56750

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56747

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56706

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56573

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56449

Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network...

EUVD-2026-56433

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56430

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56428

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56414

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network...

CVE-2026-59124

Deserialization of untrusted data in Microsoft High Performance Computing HPC Pack allows an unauthorized attacker to execute code over a network...

EUVD-2026-56307

Deserialization of untrusted data in Microsoft High Performance Computing HPC Pack allows an unauthorized attacker to execute code over a network...

EUVD-2026-56297

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56295

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...