Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

PT-2026-140041

IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2016-5983

CVE-2016-5983 IBM WebSphere deserialization of untrusted data - IBM WebSphere 7,8,8.5,9 Link to Original Writeup Source: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Title: IBM WebSphere deserialization of untrusted data Application: IBM...

CVE-2024-11394

CVE-2024-11394 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious reformer trax...

CVE-2026-119516

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20...

CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20...

CVE-2026-119516

The Radius Booking — Booking Calendar for Appointments & Services plugin (by Mamunur Rashid) is vulnerable to PHP Object Injection via the deserialization of untrusted data . This issue affects versions up to and including 1.0.20 . An attacker could potentially exploit this flaw to execute arbitr...

EUVD-2026-117999

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20...

Veeam Backup & Replication - Unauthenticated

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...

PT-2026-137862

Name of the Vulnerable Software and Affected Versions Radius Booking — Booking Calendar for Appointments & Services versions prior to 1.0.21 Description An issue exists where the software allows the deserialization of untrusted data, leading to PHP Object Injection. This allows unauthenticated...

Security Bulletin: Arbitrary Code Execution in Qiskit SDK QPY Deserialization < 13

Summary A maliciously crafted QPY payload can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY format versions | v2.6.2| Upgrade to the patched versions: qiskit v2.6.2. Workarounds and Mitigations None...

CVE-2026-118627

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118623

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2026-118627 MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118627

The MLflow platform is susceptible to a Remote Code Execution (RCE) vulnerability (CWE-502) caused by the deserialization of untrusted data . The flaw specifically exists within the loading of SHAP explainer models , where the application fails to properly validate user-supplied data. An attacker...

CVE-2026-118627

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118623

The MLflow software is vulnerable to a Remote Code Execution (RCE) vulnerability due to the unsafe deserialization of untrusted data. The flaw resides in the parsing of pickle files where the application fails to properly validate user-supplied data during the reconstruction of saved data objects...

CVE-2026-118623 MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

Security Bulletin: IBM WebSphere Application Server is affected by a Deserialization of Untrusted Data vulnerability due to Google Guava (CVE-2026-102554)

Summary There is a vulnerability in the Google Guava library that affects IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-102554 DESCRIPTION: Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through...

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the baseRmiServiceExporter bean. The issue results fro...