CVE-2026-81784 is a high severity vulnerability in Marcin Wise Chat (versions up to 3.4.2) involving deserialization of untrusted data that allows object injection. This flaw can lead to complete compromise of confidentiality, integrity, and availability. No patch or official fix information is provided.
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.
CVE-2026-81385 is a high-severity vulnerability in Microsoft 365 Apps for Enterprise, specifically in Microsoft Office Publisher. It involves deserialization of untrusted data, which could allow an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to fixed releases. An official fix is available from Microsoft.
CVE-2026-77484 is a high-severity vulnerability in Microsoft SQL Server 2019 (CU 32) involving deserialization of untrusted data. This flaw allows an authorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of SQL Server 2019 and later branches prior to specific fixed releases. An official patch is available from Microsoft to remediate this issue.
CVE-2026-65772 is a high-severity vulnerability in Microsoft Dynamics 365 (on-premises) version 9.1 involving deserialization of untrusted data. This flaw allows an authorized attacker to execute code remotely over a network. The issue affects versions from 9.0 up to but not including 9.1.0046.0006. An official fix is available in version 9.1.0046.0006. There are no known exploits in the wild at this time.
CVE-2026-47297 is a high-severity vulnerability in Microsoft SQL Server 2019 (CU 32) involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions of SQL Server 2019 and later branches, with official fixes released by Microsoft.
CVE-2026-69694 is a vulnerability in Microsoft Windows 10 Version 1607 involving deserialization of untrusted data in the Windows IP Address Management (IPAM) Service. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-12648 is a high-severity vulnerability in Ivanti Neurons for ITSM prior to version 2026.2. It involves deserialization of untrusted data, which allows a remote authenticated attacker to execute arbitrary code on the server. The vulnerability requires low attack complexity and no user interaction, but does require the attacker to have some level of privileges. This flaw impacts confidentiality, integrity, and availability of the affected system.
CVE-2026-12650 is a critical deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-12651 is a high-severity vulnerability in Ivanti Neurons for ITSM prior to version 2026.2. It involves deserialization of untrusted data, which allows a remote authenticated attacker to execute arbitrary code on the server. The vulnerability requires authentication and has no user interaction needed. It impacts confidentiality, integrity, and availability of the affected system.
CVE-2026-12745 is a critical deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM versions before 2026.2. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected server, posing a severe risk to confidentiality, integrity, and availability.
CVE-2026-12744 is a critical vulnerability in Ivanti Neurons for ITSM before version 2026.2 involving deserialization of untrusted data. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected server, posing a severe risk to confidentiality, integrity, and availability.
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Deserialization of untrusted data vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.
CVE-2026-76967 is a deserialization vulnerability in SAP NetWeaver Business Client version 8.10. The application does not sufficiently validate certain locally stored data during startup, allowing a low-privileged local attacker to replace this data with crafted content. When the application is launched, this crafted content can be processed, potentially leading to arbitrary code execution with the user's privileges. This vulnerability impacts confidentiality, integrity, and availability of the application and is rated with a high severity score of 7.8.
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection.
This issue affects CSM (Customer Service Management): before 8.0.3.
Red Hat JBoss Enterprise Application Platform (EAP) 8.1.8.GA contains a deserialization vulnerability in its Artemis messaging integration. By default, the deserialization allow-list and block-list are empty, causing all classes to be treated as trusted and deserializable. This allows an attacker who can send a crafted serialized ObjectMessage to cause arbitrary class deserialization, potentially leading to remote code execution with EAP process privileges if suitable gadget classes are available. The vulnerability affects EAP versions 7.4, 8.1, and 8.2. Mitigation involves configuring a restrictive deserialization allow-list on pooled-connection-factory resources to limit deserialization to expected classes only. Fixes are being pursued by Red Hat engineering teams.
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code on the server. The vulnerability was partially patched in version 1.23.1.