Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-9191 | 2026-10-18 | N/A | 6.3 MEDIUM | ||
| The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. | |||||
| CVE-2025-66055 | 2026-10-18 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10. | |||||
| CVE-2025-13467 | 2026-10-18 | N/A | 5.5 MEDIUM | ||
| A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration. | |||||
| CVE-2025-59245 | 1 Microsoft | 1 Sharepoint Online | 2026-10-18 | N/A | 9.8 CRITICAL |
| Microsoft SharePoint Online Elevation of Privilege Vulnerability | |||||
| CVE-2026-15679 | 2026-10-18 | N/A | 7.8 HIGH | ||
| Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987. | |||||
| CVE-2025-41700 | 1 Codesys | 1 Codesys | 2026-10-18 | N/A | 7.8 HIGH |
| An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context. | |||||
| CVE-2025-13081 | 1 Drupal | 1 Drupal | 2026-10-18 | N/A | 5.9 MEDIUM |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. | |||||
| CVE-2026-69836 | 1 Microsoft | 1 Entra Id | 2026-10-18 | N/A | 10.0 CRITICAL |
| Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-64408 | 1 Apache | 1 Causeway | 2026-10-18 | N/A | 6.3 MEDIUM |
| Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue. | |||||
| CVE-2025-55182 | 2 Facebook, Vercel | 2 React, Next.js | 2026-10-18 | N/A | 10.0 CRITICAL |
| A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. | |||||
| CVE-2025-66571 | 2026-10-18 | N/A | N/A | ||
| UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code. | |||||
| CVE-2026-55573 | 2026-10-16 | N/A | 9.8 CRITICAL | ||
| e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7. | |||||
| CVE-2026-75941 | 2026-10-16 | N/A | 8.0 HIGH | ||
| A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code. | |||||
| CVE-2026-111094 | 1 Jetbrains | 1 Teamcity | 2026-10-16 | N/A | 8.1 HIGH |
| In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | |||||
| CVE-2026-109360 | 2026-10-16 | N/A | 7.5 HIGH | ||
| MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True. | |||||
| CVE-2026-110812 | 2026-10-16 | N/A | 9.9 CRITICAL | ||
| Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1) | |||||
| CVE-2026-49950 | 2026-10-16 | N/A | 9.8 CRITICAL | ||
| Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes. | |||||
| CVE-2026-109391 | 2026-10-16 | N/A | 8.1 HIGH | ||
| Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution. | |||||
| CVE-2026-96186 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-88091 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-16 | N/A | 7.8 HIGH |
| Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | |||||