CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360 BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-1360

BuddyPress for WordPress up to 14.5.0 is affected by a Deserialization of Untrusted Data flaw in bp_unserialize_profile_field(), which calls unserialize() without the allowed_classes parameter on user-controlled XProfile field data. This allows an authenticated attacker (subscriber level or highe...

EUVD-2026-50968

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

CVE-2026-14602: Improper Control of Generation of Code

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-1360: Deserialization of Untrusted Data

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bpunserializeprofilefield function using @unserialize without the allowedclasses parameter on user-controlled XProfile field data. This makes it...

PT-2026-66635

Name of the Vulnerable Software and Affected Versions Hugging Face PyTorch Image Models affected versions not specified Description Remote attackers can execute arbitrary code on affected installations due to improper validation of user-supplied data during the parsing of checkpoints. This leads ...

PT-2026-66473

e107 prior to version 2.3.8 contains a code execution vulnerability in the e array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user prefs column. The e array::unserialize function in e107...

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2026-12118: Deserialization of Untrusted Data

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

PT-2026-66390

Name of the Vulnerable Software and Affected Versions Remote API WordPress plugin versions prior to 0.3 Description The plugin fails to authenticate requests before deserializing user-supplied input. This allows unauthenticated attackers to perform PHP Object Injection, a technique where maliciou...

IBM WebSphere Application Server deserialization vulnerability (CNVD-2026-31549)

IBM WebSphere Application Server is an application server product from IBM. There is a security vulnerability in IBM WebSphere Application Server. This vulnerability stems from the lack of adequate security checks during the serialization data processing process, allowing unauthenticated users to...

CVE-2026-11536: Deserialization of Untrusted Data

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-15969: Deserialization of Untrusted Data

SGLang contains an unauthenticated RCE in /loadloraadapterfromtensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads...

PT-2026-66355

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the bp unserialize profile field function using @unserialize without the allowed classes parameter on user-controlled XProfile field data. This makes ...

PT-2026-66538

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration on prem version 10.11 IBM webMethods Integration on prem version 10.15 Description An unauthenticated remote attacker can execute arbitrary code on the system. This is possible due to the deserialization of untrusted...

CVE-2026-54365: Missing Authentication for Critical Function

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

Apache Traffic Server deserialization injection vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a deserialization injection vulnerability, which stems from improper handling of disk cache fields and object lifecycle management. Attackers can...

CVE-2026-57859: Deserialization of Untrusted Data

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...