Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-49107 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |||||
| CVE-2026-12118 | 1 Ibm | 1 Webmethods Integration | 2026-10-23 | N/A | 9.8 CRITICAL |
| IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | |||||
| CVE-2025-11367 | 1 N-able | 1 N-central | 2026-10-23 | N/A | 9.8 CRITICAL |
| The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization | |||||
| CVE-2025-62025 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8. | |||||
| CVE-2026-57859 | 2026-10-23 | N/A | 7.5 HIGH | ||
| e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load(). | |||||
| CVE-2025-62035 | 2026-10-23 | N/A | 8.8 HIGH | ||
| Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. | |||||
| CVE-2026-3245 | 2026-10-23 | N/A | 7.5 HIGH | ||
| A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. | |||||
| CVE-2026-11536 | 1 Ibm | 1 Websphere Application Server | 2026-10-23 | N/A | 8.5 HIGH |
| IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | |||||
| CVE-2026-28139 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | |||||
| CVE-2026-71281 | 2026-10-23 | N/A | 8.8 HIGH | ||
| Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. | |||||
| CVE-2026-73376 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | |||||
| CVE-2026-18642 | 2026-10-23 | N/A | 7.8 HIGH | ||
| Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4. | |||||
| CVE-2026-12155 | 1 Ibm | 2 Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | N/A | 6.5 MEDIUM |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. | |||||
| CVE-2026-12148 | 1 Ibm | 2 Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | N/A | 7.5 HIGH |
| IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | |||||
| CVE-2026-18634 | 2026-10-23 | N/A | 8.4 HIGH | ||
| An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component. | |||||
| CVE-2026-111628 | 2026-10-23 | N/A | 5.0 MEDIUM | ||
| 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes. | |||||
| CVE-2026-17061 | 2026-10-23 | N/A | 10.0 CRITICAL | ||
| A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. | |||||
| CVE-2026-48397 | 2 Adobe, Microsoft | 2 Lightroom, Windows | 2026-10-23 | N/A | 8.6 HIGH |
| Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | |||||
| CVE-2026-28149 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | |||||
| CVE-2026-28176 | 2026-10-23 | N/A | 8.8 HIGH | ||
| Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. | |||||