Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-35464 | 1 Forgerock | 2 Access Management, Openam | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier | |||||
| CVE-2021-35227 | 1 Solarwinds | 1 Access Rights Manager | 2026-06-17 | 4.6 MEDIUM | 4.7 MEDIUM |
| The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. | |||||
| CVE-2021-35218 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 6.5 MEDIUM | 8.9 HIGH |
| Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server | |||||
| CVE-2021-35217 | 1 Solarwinds | 1 Patch Manager | 2026-06-17 | 6.5 MEDIUM | 8.9 HIGH |
| Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data. | |||||
| CVE-2021-35216 | 1 Solarwinds | 1 Patch Manager | 2026-06-17 | 9.0 HIGH | 8.9 HIGH |
| Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution. | |||||
| CVE-2021-35215 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 6.5 MEDIUM | 8.9 HIGH |
| Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability. | |||||
| CVE-2021-35196 | 1 Theologeek | 1 Manuskript | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file | |||||
| CVE-2021-35095 | 1 Qualcomm | 20 Ar8035, Ar8035 Firmware, Qca8081 and 17 more | 2026-06-17 | 6.9 MEDIUM | 8.4 HIGH |
| Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectivity, Snapdragon Mobile | |||||
| CVE-2021-34992 | 1 Orckestra | 1 C1 Cms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. Authentication is required to exploit this vulnerability. The specific flaw exists within Composite.dll. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-14740. | |||||
| CVE-2021-34394 | 1 Nvidia | 9 Jetson Agx Xavier 16gb, Jetson Agx Xavier 32gb, Jetson Agx Xavier 8gb and 6 more | 2026-06-17 | 4.6 MEDIUM | 4.2 MEDIUM |
| Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs. An incorrect message stream deserialization allows an attacker to use the malicious CA that is run by the user to cause the buffer overflow, which may lead to information disclosure and data modification. | |||||
| CVE-2021-34393 | 1 Nvidia | 10 Jetson Agx Xavier 16gb, Jetson Agx Xavier 32gb, Jetson Agx Xavier 8gb and 7 more | 2026-06-17 | 2.1 LOW | 4.2 MEDIUM |
| Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure. | |||||
| CVE-2021-34371 | 1 Neo4j | 1 Neo4j | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains. | |||||
| CVE-2021-34066 | 1 Edgegallery | 1 Developer-be | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file. | |||||
| CVE-2021-33898 | 1 Invoiceninja | 1 Invoice Ninja | 2026-06-17 | 6.8 MEDIUM | 8.1 HIGH |
| In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it. | |||||
| CVE-2021-33806 | 1 Bdew | 1 Bdlib | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization. | |||||
| CVE-2021-33790 | 2 Minecraft, Techreborn | 2 Minecraft, Reborncore | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An attacker can instantiate any class on the classpath with any data. A class usable for exploitation might or might not be present, depending on what Minecraft modifications are installed. | |||||
| CVE-2021-33728 | 1 Siemens | 1 Sinec Nms | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges. | |||||
| CVE-2021-33420 | 1 Replicator Project | 1 Replicator | 2026-06-17 | N/A | 9.8 CRITICAL |
| A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object. | |||||
| CVE-2021-33207 | 1 Softwareag | 1 Mashzone Nextgen | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code. | |||||
| CVE-2021-33176 | 1 Octavolabs | 1 Vernemq | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system. | |||||