37605 matches found
EUVD-2026-53854
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...
Security Bulletin: Security vulnerabilities have been found in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
Summary WebSphere Application Server is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about security vulnerabilities affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed...
PT-2026-68567
Name of the Vulnerable Software and Affected Versions Agora versions prior to 2.0 Description The Agora Event & Conference WordPress Theme is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no P...
PT-2026-68564
Name of the Vulnerable Software and Affected Versions Accalia versions prior to 1.5.4 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...
PT-2026-68562
Name of the Vulnerable Software and Affected Versions Abelle versions prior to 1.23 Description The Abelle theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. Deserialization is the process of converting a stored dat...
PT-2026-68563
Name of the Vulnerable Software and Affected Versions Abogado versions prior to 1.19 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no POP chain a sequence of gadgets used t...
PT-2026-68569
Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...
PT-2026-68561
Name of the Vulnerable Software and Affected Versions A.Williams versions prior to 1.3.2 Description The A.Williams plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This issue occurs when the application processe...
JetBrains TeamCity Command Execution
The vulnerability of the web interface of the CI/CD application integration and delivery system JetBrains TeamCity is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security measures and execute arbitrary operati...
EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2949)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
CVE-2026-65552: Deserialization of Untrusted Data
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-66909: Deserialization of Untrusted Data
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...
PT-2026-68565
Name of the Vulnerable Software and Affected Versions Adrena versions prior to 1.2.15 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadget...
CVE-2026-65574: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65577: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
PT-2026-68566
Name of the Vulnerable Software and Affected Versions Advice versions prior to 1.18.1 Description The Advice - Psychology, Therapy & Counseling Theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection...
TencentOS Server 3: pki-deps:10.6 (TSSA-2026:0824)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0824 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2908)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
PT-2026-68826
Name of the Vulnerable Software and Affected Versions Azure Service Bus affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object, which...