CVE-2026-104734: Deserialization of Untrusted Data

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

PT-2026-116196

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.3.3 Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input during the ZIP template import process. This allow...

CVE-2026-87697

A flaw was found in dotnet. A remote attacker can achieve arbitrary code execution by tricking an application or user into processing maliciously crafted data during deserialization the process of reconstructing data into an application object. Successful exploitation allows the attacker to execu...

CVE-2026-83520

A flaw was found in .NET. An insecure deserialization vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution over a network. By convincing an application or user to process specially crafted serialized data, an attacker can execute malicious commands with the...

CVE-2026-70035

A flaw was found in .NET. The vulnerability stems from insecure deserialization, where data transmitted over a network is reconstructed without adequate validation. A remote, unauthenticated attacker could exploit this issue by convincing a user to process specially crafted input. Successful...

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. T...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Jackson Databind

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-54516 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-mode...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Jackson Databind

Summary IBM SPSS Modeler is affected by vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-54516 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

CVE-2026-64610

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84064 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special...

CVE-2026-64610

Apache Kylin versions 4 through 5.0.4 are vulnerable to a Deserialization of Untrusted Data vulnerability. The root cause is unsafe Java deserialization occurring from a broken external cache service. This issue could lead to significant security impacts, including high confidentiality, integrity...

EUVD-2026-102853

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-64610 Apache Kylin: Redis unsafe Java deserialization

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

Exploit for CVE-2026-78165

CVE-2026-78165 — camel-spring-redis: unfiltered JDK deserializ...

CVE-2026-97296

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...

CVE-2026-104730

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...

EUVD-2026-102810

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...

CVE-2026-97296 WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1...

CVE-2026-104730

The Sunshine Photo Cart WordPress plugin (versions up to and including 3.7.4 ) is vulnerable to PHP Object Injection due to the deserialization of untrusted input via the 'key' parameter . Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless a POP chain is...