PT-2026-117227

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp common/hanlp common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiat...

PT-2026-117233

A vulnerability was found in ESPnet up to 202610.post2. This affects the function build model of the file espnet3/publication/inference model.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack...

PT-2026-117330

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

CVE-2026-112081: Deserialization of Untrusted Data

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

PT-2026-117369

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The Camel-Jgroups component contains a deserialization of untrusted data issue. The JGroupsEndpoint.createExchangeMessage function, called by...

PT-2026-117327

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The camel-hazelcast component fails to apply a JavaSerializationFilterConfig to Hazelcast instances created through specific configuration paths...

yaml-payload

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

CVE-2026-28326-check

SolarWinds Access Rights Manager Unauthenticated RCE — Vulnerability Detection Script An unauthenticated patch-state check for CVE-2026-28326, the unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager ARM, fixed in ARM 2026.2.1 on 2026-09-17. CWE-798, CVSS 8.8 Hi...

CVE-2020-9496

CVE-2020-9496 ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión XML-RPC request are vulnerable to unsafe deserialization. Steps Step 1: pip3 install -r requeriments.txt Step 2: nc -nlvp attack computer Step 3: python3 shell.py -i -p -li -lp Step 4: You should have a shell in your nc liste...

CVE-2026-110886

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

CVE-2026-107436

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12...

EUVD-2026-103433

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12...

EUVD-2026-103430

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

CVE-2026-110886

The QuantumCloud Conversational Forms for ChatBot WordPress plugin (versions up to and including 1.5.1 ) is vulnerable to a PHP Object Injection flaw. This vulnerability arises from the deserialization of untrusted data , allowing an attacker to inject objects into the application. The vulnerabil...

CVE-2026-107436 WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12...

CVE-2026-107436

The WP Chill Strong Testimonials WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This issue affects versions from n/a through 3.3.12 . An attacker could exploit this to perform Object Injection , potentially impacting the confidentiality, inte...

CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...

CVE-2022-26133

CVE-2022-26133 Information Description SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated...

React4Shell

React2Shell Exploit Proof of Concept PoC for React Server Components RSC / Next.js Remote Code Execution vulnerability. Description A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following...

CVE-2026-111868

A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. T...