CWE-502: Deserialization of Untrusted Data vulnerabilities

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a deserialization vulnerability (CWE-502) that could allow an attacker with access to the server secret and Redis write permissions to submit malicious serialized cache values. When these values are deserialized, attacker-controlled code could execute with the privileges of the service process. This vulnerability has a high severity rating with a CVSS score of 7.5.

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the ability to write manipulated data to the cache backend used by Magento—such as Redis or Memcached—could inject specially crafted PHP objects and trigger their deserialization, potentially leading to arbitrary code execution via gadget strings available in the application environment. Exploitation therefore requires a prerequisite condition that allows writing to the cache infrastructure, either through access to the local file system or to a cache infrastructure accessible from the Magento environment.

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

A vulnerability in all versions of dormakaba evolo Service allows remote attackers to execute arbitrary code with SYSTEM privileges via a .NET component. This issue enables full system compromise if exploited.

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

CVE-2026-103877 is a critical deserialization of untrusted data vulnerability in Apache Directory LDAP API versions from 2.1.0 up to but not including 2.1.9. A malicious or compromised LDAP server, or a man-in-the-middle before TLS encryption, can respond to a client's loadSchema() subschema search with a specially crafted schema object containing a serialized Java class. This can lead to remote code execution (RCE). The issue is fixed in version 2.1.9.

A vulnerability in Foreman’s foreman-rake initialization logic allows Server-Side Template Injection (SSTI) and insecure deserialization, creating a multi-stage execution chain. This flaw can lead to remote code execution and full infrastructure compromise. The issue is tracked as CVE-2026-12544 with a high severity score of 7.7. Red Hat has released an official security advisory with patches addressing this and related vulnerabilities in Red Hat Satellite 6.19 for RHEL 9.

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

CVE-2026-102108 is a high-severity vulnerability in Kiteworks Email Protection Gateway where an authenticated administrator with specific queue-management privileges can submit a crafted serialized object to a cluster management interface. This object is deserialized without sufficient validation, potentially allowing arbitrary code execution under the gateway service account. The vulnerability affects versions prior to 9.5.0.

CVE-2026-102135 is a deserialization vulnerability in Kiteworks Email Protection Gateway when database replication is enabled. A trusted cluster peer can submit a crafted serialized object that is deserialized without sufficient validation, potentially leading to code execution as the gateway service account. Replication is disabled by default, and exploitation requires control of a trusted cluster peer or administrative access. The vulnerability affects versions prior to 9.5.1.

Kiteworks Core versions before 9.5.0 contain a deserialization vulnerability (CWE-502) that could allow remote code execution if an attacker can influence the deserialized data. Exploitation requires the attacker to control the input data, so the vulnerability is not exploitable on its own. The issue is rated high severity with a CVSS score of 8.1.

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.