Total
3272 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73699 | 2026-09-10 | 7.2 High | ||
| FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into the permissions table columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths. | ||||
| CVE-2026-57822 | 1 Apache | 2 Activemq Artemis, Artemis | 2026-09-10 | 6.5 Medium |
| When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue. | ||||
| CVE-2026-47878 | 2 Broadcom, Spring | 2 Spring Batch, Spring Batch | 2026-09-10 | 5.6 Medium |
| DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier | ||||
| CVE-2026-87822 | 2026-09-10 | 7.5 High | ||
| t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations. | ||||
| CVE-2026-69694 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-10 | 7 High |
| Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-47880 | 2 Spring, Vmware | 2 Spring Integration, Spring Integration | 2026-09-10 | 5.4 Medium |
| A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier | ||||
| CVE-2026-81784 | 2026-09-10 | 8.1 High | ||
| Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions. | ||||
| CVE-2026-82925 | 2026-09-10 | 8.1 High | ||
| The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site. | ||||
| CVE-2024-58381 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 7.5 High |
| PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash. | ||||
| CVE-2026-12744 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.8 Critical |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12650 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.9 Critical |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12745 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 9.8 Critical |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12651 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 8.8 High |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-12648 | 1 Ivanti | 1 Neurons For Itsm | 2026-09-10 | 8.8 High |
| A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. | ||||
| CVE-2026-87874 | 1 Redhat | 2 Ceph Storage, Openstack | 2026-09-09 | 8.1 High |
| A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution. | ||||
| CVE-2026-81385 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-09-09 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-47297 | 1 Microsoft | 3 Sql Server 2019, Sql Server 2022, Sql Server 2025 | 2026-09-09 | 8.1 High |
| Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-87930 | 1 Max-3000 | 1 Maxsite Cms | 2026-09-09 | 8.1 High |
| MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist. | ||||
| CVE-2026-65772 | 1 Microsoft | 1 Dynamics 365 | 2026-09-09 | 8.8 High |
| Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-11363 | 2026-09-09 | 6.6 Medium | ||
| The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself. | ||||