A critical deserialization vulnerability exists in the TYPO3 extension "HTML5 Video Player vs. Powermail" (versions up to 0.2.1). The extension unsafely processes attacker-controlled cookie data using PHP's unserialize(), enabling remote unauthenticated attackers to trigger PHP Object Injection and potentially achieve remote code execution on the server.
CVE-2026-78265 is a critical vulnerability in Nexcess The Events Calendar plugin, affecting versions up to and including 6.17.2. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows an attacker to execute arbitrary code remotely without requiring authentication.
CVE-2026-78262 is a critical vulnerability in WP Project Manager versions up to and including 4.0.6. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.
CVE-2026-32563 is a critical vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to and including 2.0.63. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability of affected systems.
Combodo iTop versions prior to 3.2.3 contain a vulnerability in the user preference functionality that allows PHP object injection, potentially leading to remote code execution. This vulnerability is identified as CWE-502 (Deserialization of Untrusted Data) and CWE-94 (Code Injection). The issue has been resolved in version 3.2.3.
CVE-2026-66650 is a critical vulnerability in Theme-Rex FreightCo versions up to and including 1.1.15. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.
CVE-2026-78147 is a medium severity vulnerability in the ggml-org llama.cpp project affecting the deserialize_tensor function in the ggml-RPC Server component. The flaw involves improper handling of op/op_params arguments during deserialization, which can be triggered remotely. No patch or fix information is currently available, and no known exploits are reported in the wild.
The PPWP – Password Protect Pages WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the 'post_protection_roles' parameter in all versions up to and including 1.9.18. This vulnerability requires authenticated users with Contributor-level access or higher. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, attackers could potentially delete files, access sensitive data, or execute arbitrary code.
The WS Form LITE – Drag & Drop Contact Form Builder WordPress plugin up to version 1.10.80 is vulnerable to PHP Object Injection via deserialization of untrusted form submission meta values. This vulnerability allows unauthenticated attackers to inject PHP objects. However, exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme. Without such a POP chain, this vulnerability has no impact. If a suitable POP chain exists, attackers could potentially delete files, access sensitive data, or execute arbitrary code.
BabelDOC versions prior to 0.6.3 contain a deserialization vulnerability in their vendored PDF parser. The vulnerability arises from unsafe deserialization of pickle data in CMap files, which can be manipulated via path traversal to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is resolved in version 0.6.3.
CVE-2026-77646 is a high-severity vulnerability in PTC Windchill PDMLink and PTC FlexPLM involving deserialization of untrusted data that can lead to Server-Side Request Forgery (SSRF). This vulnerability allows an attacker to exploit the system without authentication, potentially causing unauthorized requests from the server. Multiple specific versions of Windchill PDMLink are affected. No patch or official remediation details are provided in the available data.
CVE-2026-77645 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM. It arises from improper input validation related to deserialization of untrusted data. The vulnerability affects multiple specific versions of Windchill PDMLink. The CVSS 4.0 score is 9.2, indicating a critical severity level. No patch or vendor advisory details are provided in the input. There are no known exploits in the wild at this time.
CVE-2026-69836 is a critical vulnerability in Microsoft Entra ID involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute arbitrary code remotely over a network. The vulnerability has a CVSS score of 10.0, indicating maximum severity with high impact on confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-15679 is a high-severity vulnerability in Hugging Face PyTorch Image Models version 1.0.24. It involves deserialization of untrusted data from model checkpoints, allowing remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The flaw arises from improper validation during checkpoint parsing, enabling code execution in the context of the current process.
CVE-2026-18285 is a high-severity vulnerability in Aeon version 1.3.0 involving deserialization of untrusted data in the load_rehab_pile_dataset method. This flaw allows remote attackers to execute arbitrary code if a user interacts with malicious content, such as visiting a crafted page or opening a malicious file. The vulnerability arises from improper validation of user-supplied data during deserialization, enabling code execution in the context of the affected process.
CVE-2026-73993 is a critical vulnerability in Roxnor FundEngine versions up to and including 1.7.9. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without requiring authentication.
CVE-2026-66672 is a critical vulnerability in Monkeysan Flatastic versions up to and including 2.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without authentication.
CVE-2026-66583 is a critical vulnerability in WPMU DEV's Forminator plugin, affecting versions up to and including 1.57.0. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.
CVE-2026-44901 is a deserialization vulnerability in Wazuh versions from 4.0.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta2. The flaw exists in the AffectedItemsWazuhResult.merge() function, which improperly trusts the sort_casting field in a cluster worker's JSON response. This allows a compromised worker to execute arbitrary Python code as root on the master node during distributed API merges. The issue is fixed in versions 4.14.6 and 5.0.0-beta2.
Dell Command Update (DCU) versions prior to 5.7.1 contain a deserialization of untrusted data vulnerability (CWE-502). This flaw allows a low privileged local attacker to potentially elevate their privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific patch link is provided, but the vulnerability is fixed starting from version 5.7.1.