Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.
AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
User Profile Builder WordPress plugin versions 3.3.4 and earlier contain a deserialization vulnerability in a free add-on feature that is disabled by default. This flaw allows high privilege users, such as administrators, to perform PHP Object Injection by importing crafted configuration files without proper data type validation. The plugin itself does not include a gadget chain for exploitation, so further impact depends on the presence of suitable gadgets in other installed plugins or components. No official patch or remediation guidance is currently available.
CVE-2026-82222 is a critical vulnerability in Liquid Web / StellarWP GiveWP involving deserialization of untrusted data, which allows object injection. The vulnerability affects GiveWP versions up to 4.16.7.1. It has a CVSS score of 10.0, indicating a critical severity with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. No official patch or remediation information is currently available.
A deserialization vulnerability exists in the User Frontend WordPress plugin before version 4.3.10. It improperly validates field type definitions and deserializes user-controlled post metadata when rendering submitted posts. This allows users with Editor-level access or higher to inject arbitrary PHP objects, potentially leading to remote code execution if a suitable POP chain is present.
CVE-2026-78612 is an authenticated SQL injection vulnerability in WatchGuard Dimension's scheduled report feature. It allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 8.6, indicating high severity.
CVE-2026-78614 is an authenticated SQL injection vulnerability in WatchGuard Dimension's audit report feature. It allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 8.6, indicating high severity.
CVE-2026-59306 is a low-severity vulnerability in Spring Cloud Stream that involves the potential deserialization of untrusted data. It affects specific versions of Spring Cloud Stream, including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability is classified under CWE-502, which concerns unsafe deserialization practices. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.
CVE-2026-59307 is a high severity vulnerability in Spring Integration involving deserialization of untrusted data. The issue arises when an operator attempts to restrict deserialization using JdbcMessageStore.addAllowedPatterns(...) but receives no protection if the store is a Spring-managed bean. This affects multiple versions of Spring Integration including 7.1.0, 7.0.0 to 7.0.5, 6.5.0 to 6.5.10, and 6.4.0 to 6.4.12. The vulnerability is related to CWE-502, which concerns unsafe deserialization. No official patch or remediation guidance is currently provided by the vendor. The CVSS 3.1 score is 8.0, indicating high severity with network attack vector, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.
CVE-2026-78292 is a critical unauthenticated PHP Object Injection vulnerability affecting Hash Form versions up to and including 1.4.1. It involves deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without authentication.
CVE-2026-78286 is a critical vulnerability in INFINITUM FORM Geo Controller versions up to 8.9.8. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-78276 is a high-severity vulnerability in WP Manage Ninja's Fluent Boards Pro plugin, affecting versions up to and including 2.0.11. It involves PHP object injection due to deserialization of untrusted data, classified under CWE-502. This flaw can lead to complete compromise of confidentiality, integrity, and availability if exploited. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-78257 is a high severity vulnerability involving PHP Object Injection due to deserialization of untrusted data in the Booking and Rental Manager product by magepeopleteam. It affects versions up to and including 2.7.5. The vulnerability allows an attacker with network access and low privileges to execute arbitrary code, causing high impact on confidentiality, integrity, and availability.
CVE-2026-59275 is a deserialization vulnerability in Spring AMQP that allows a single malicious AMQP message to cause the entire consumer JVM to terminate via System.exit(99), resulting in complete availability loss for all workloads running in that process. It affects multiple versions of Spring AMQP, including 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data).
CVE-2026-47878 is a medium severity vulnerability in Spring Batch affecting versions 5.2.6 and earlier, and 6.0.0 through 6.0.4. It involves unsafe deserialization where the DefaultExecutionContextSerializer passes Base64-decoded data directly to ObjectInputStream.readObject() without applying an ObjectInputFilter to restrict deserialized types to a trusted allowlist. This can lead to potential integrity, confidentiality, and availability impacts.
CVE-2026-47875 is a medium severity vulnerability in Spring Batch affecting versions 5.2.0 through 5.2.6 and 6.0.0 through 6.0.4. It involves unsafe deserialization of untrusted data when using Jackson2ExecutionContextStringSerializer, allowing attackers to bypass trusted-types allowlist enforcement in JobParameterDeserializer. This can lead to arbitrary code execution via known Jackson RCE gadgets.
CVE-2026-47864 is a deserialization vulnerability in Spring Integration's SerializingHttpMessageConverter. It deserializes HTTP request bodies with a raw ObjectInputStream without class filtering, allowing remote unauthenticated attackers to execute arbitrary code if a suitable Java deserialization gadget is present on the classpath. The vulnerability affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The CVSS score is 6.4 (medium severity). No official patch or remediation guidance is currently provided.
CVE-2026-47856 is a medium severity vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The issue arises from deserialization of untrusted data via the json__TypeId__ header, which is used without a type or package allow-list, allowing arbitrary class resolution. This vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data). No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.