PT-2026-68826

Name of the Vulnerable Software and Affected Versions Azure Service Bus affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object, which...

CVE-2026-28139: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-65549: Deserialization of Untrusted Data

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-65578: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Agora = 1.9 versions...

CVE-2026-65579: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...

CVE-2026-65581: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...

CVE-2026-65576: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...

PT-2026-68568

Name of the Vulnerable Software and Affected Versions Agricola versions prior to 1.22.0 Description The Agricola - Agriculture & Organic Farm Theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection...

CVE-2026-65556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...

PT-2026-68465

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12 Description The JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization without type...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2949)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

TencentOS Server 3: pki-deps:10.6 (TSSA-2026:0824)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0824 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP15 : ruby (EulerOS-SA-2026-2908)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-23001 – Hugging Face Transformers Model Deserializati...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528)

Summary The security issue described in CVE-2026-14512, CVE-2026-14528 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixe...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the CreateAction and EditAction processes when user-supplied POST parameters are deserialized without restricting the classes that may be instantiated. An attacker can execute arbitrary code or...

CVE-2026-70426

The Remoting component (versions 3384.v60d89463d9e0 and earlier, excluding 3355.3357.v931d3c992987 ) included in Jenkins versions 2.575 and earlier (and LTS 2.568.1 and earlier) is vulnerable to a deserialization filter bypass. The root cause is that the JEP-200 class filter is not applied to cla...

CVE-2026-70426

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...