CWE-502: Deserialization of Untrusted Data vulnerabilities

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

CVE-2026-13046 is a high-severity vulnerability in WatchGuard Fireware OS affecting its SAML single sign-on session handling component (samld). It involves deserialization of untrusted data, allowing an attacker with file write access on the appliance to execute arbitrary code within the samld service context. The vulnerability affects multiple version ranges of Fireware OS prior to certain patch levels.

A deserialization vulnerability exists in Amazon GluonTS before version 0.17.0 in the model loading component. This flaw allows attackers who can supply crafted serialized model directories to execute arbitrary operating system commands with the privileges of the loading process. The issue is resolved in version 0.17.0 and later.

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

CVE-2026-81867 is a critical deserialization of untrusted data vulnerability in the JavaScript Task component of Google Cloud Application Integration. It affects versions prior to 2026-06-28 and allows an authenticated user with standard permissions to execute arbitrary code on shared production servers by using a specially crafted script. The vulnerability was patched on June 28, 2026, and no customer action is required.

Apache Roller 6.1.5 contains a critical deserialization vulnerability in its XML-RPC endpoint that allows unauthenticated remote attackers to cause deserialization of attacker-controlled data. This occurs because the endpoint accepts vendor extension types that are deserialized before authentication, even if the XML-RPC feature is disabled globally. This flaw can lead to remote code execution. Upgrading to Apache Roller 6.1.6 or later mitigates the issue by disabling these extension types and rejecting requests when XML-RPC is disabled.

The Online Scheduling and Appointment Booking System WordPress plugin before version 28.3 contains a vulnerability that allows users with a custom booking-management capability to perform deserialization of untrusted data. This flaw enables injection of arbitrary PHP objects, overwriting of privileged site options, and reading of stored integration secrets. The vulnerability arises because the plugin does not restrict a privileged maintenance feature exclusively to administrators and fails to prevent unsafe deserialization. The issue affects versions from 23.2 up to but not including 28.3.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.

CVE-2026-96745 is a medium severity vulnerability in the MongoDB PHP Driver involving deserialization of untrusted data in the command monitoring feature. An unauthenticated attacker who controls data included in a database operation can cause the driver to instantiate application classes implementing the driver's persistable interface, invoking their unserialization methods with attacker-supplied data. The impact depends on the classes present in the application. This vulnerability affects multiple version ranges of the MongoDB PHP Driver prior to fixed versions 1.21.10, 2.1.10, and 2.5.3.

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.