A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.
CVE-2026-69659 is a medium severity vulnerability in ash-project ash affecting versions from 1.17.0 up to but not including 3.31.1. It involves uncontrolled resource consumption due to deserialization of untrusted data in keyset pagination cursors. The vulnerability arises because the application base64-decodes and then deserializes client-supplied pagination cursors without bounding their size, allowing an attacker to cause excessive memory allocation and potentially crash the node.
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
CVE-2026-71559 is a deserialization of untrusted data vulnerability in the Go implementation of Apache Fory. An attacker can cause a denial of service by supplying crafted data with malformed type metadata, triggering an uncaught panic. This affects Apache Fory versions from 0.16.0 up to but not including 1.5.0. The issue is fixed in version 1.5.0.
CVE-2026-71558 is a critical heap type confusion vulnerability in Apache Fory C++ polymorphic smart-pointer deserialization. Versions from 0.14.0 up to but not including 1.5.0 are affected. A crafted payload can bypass type compatibility checks, causing an incompatible object to be treated as a base type, potentially leading to denial of service or arbitrary code execution. The issue is fixed in Apache Fory 1.5.0. Applications not using this deserialization feature are not affected.
CVE-2026-71560 is a critical vulnerability in Apache Fory C++ affecting versions from 0.14.0 before 1.5.0. It involves an out-of-bounds read during deserialization of structs containing tagged integer fields, which can lead to information disclosure or denial of service. The issue is fixed in Apache Fory 1.5.0. Applications not using Apache Fory C++ or tagged integer fields are not affected.
Ajax Search Lite WordPress plugin versions before 4.14.5 contain a deserialization vulnerability that allows unauthenticated attackers to perform PHP Object Injection. This can lead to remote code execution if a suitable gadget chain is present in the environment. The vulnerability is identified as CWE-502 and has a critical CVSS score of 9.8.
CVE-2026-65581 is a critical vulnerability in Axiomthemes AI ANN versions up to and including 1.29.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without any authentication. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-65579 is a critical vulnerability in axiomthemes Agricola versions up to and including 1.21.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). The vulnerability allows an attacker to execute arbitrary code without authentication.
CVE-2026-65578 is a critical vulnerability in AncoraThemes Agora versions 1.9 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without authentication. The CVSS 3.1 score is 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-65577 is a critical vulnerability in AncoraThemes Advice versions up to and including 1.18.0. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.
CVE-2026-65576 is a critical vulnerability in AncoraThemes Adrena versions up to and including 1.2.14. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This flaw allows remote attackers to execute arbitrary code without any authentication.
CVE-2026-65575 is a critical vulnerability in AncoraThemes Accalia versions up to and including 1.5.3. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.