CVE-2026-10043 is a high-severity vulnerability in MosaicML Composer version 0.32.1 involving deserialization of untrusted data. The flaw occurs during the parsing of checkpoints, where insufficient validation allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. This vulnerability can lead to full compromise of the affected process.
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.
Affected versions:
Spring Statemachine 4.0.0 through 4.0.1
Spring Statemachine 3.2.0 through 3.2.4
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain a wrapper". When the input has the form phar:///path/file.phar/inner with three or more slashes after the scheme, parse_url returns boolean false instead of returning the scheme string. The is_string($scheme) branch is therefore skipped, the helper returns without throwing, and the caller proceeds. PHP's stream layer, however, still treats phar:///... as a valid phar wrapper and opens the underlying phar file. The result is that IOFactory::load($attackerPath) walks past the patch and still touches the phar wrapper. On PHP 7.x, simply reaching the phar wrapper via is_file is enough for PHP to automatically deserialize the phar metadata, which in turn invokes the magic methods __wakeup and __destruct of an attacker controlled object and gives full RCE. On PHP 8.x, automatic metadata deserialization for plain file ops was removed, so the chain at the PhpSpreadsheet layer reduces to a phar wrapper file read primitive, and RCE only resurfaces if the downstream consumer ever calls Phar::getMetadata. This vulnerability is fixed in 1.30.5.
SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue.
Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][<trans_id>]['command_obj']: the close endpoint via close_sqleditor_session(), and update_sqleditor_connection via check_transaction_status(). In server mode these endpoints were reachable without any authenticated pgAdmin session.
The defect is a missing-authentication-on-critical-function (CWE-306) wrapper around a deserialization-of-untrusted-data sink (CWE-502). Exploiting it for remote code execution requires the attacker to also forge a server-side session file whose gridData entry contains a malicious pickle payload, which in turn requires both (a) knowledge of pgAdmin's Flask SECRET_KEY (no chain to leak it is described here -- the attacker must already possess it) and (b) write access to pgAdmin's sessions/ directory on the host. Neither precondition is granted by this defect on its own. When those preconditions are met from another channel (misconfigured deployment, prior compromise, leaked configuration), the missing auth gate is the final hop that turns an existing partial compromise into unauthenticated code execution in the pgAdmin process -- and, by extension, on the host under whatever account runs pgAdmin.
Fix is a one-line @pga_login_required decorator on each of the two endpoints, matching the convention used by every other route in the module. The is_authenticated / MFA chain now runs before the trans_id is dereferenced, so an unauthenticated request is rejected before reaching the deserialization path.
The defect is server-mode only. In DESKTOP mode pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request, so no endpoint can be exercised in an unauthenticated state and no auth decorator (or its absence) is meaningful. The accompanying regression test mirrors the attacker's path -- harvests an X-pgA-CSRFToken from GET /login and replays it against both endpoints -- and self-skips outside server mode for that reason; it is wired into the existing server-mode CI workflow alongside the data-isolation tests.
This issue affects pgAdmin 4: from 6.9 before 9.16.
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions
* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CVE-2025-60236 is a critical vulnerability in EMV Creatify versions up to and including 1.5. It involves deserialization of untrusted data, which allows an attacker to perform object injection. This vulnerability has a high CVSS score of 9.8, indicating it can lead to complete compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2025-60231 is a critical deserialization of untrusted data vulnerability in EMV The Hospital software up to version 1.8.1. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a severe risk with network attack vector and no required privileges or user interaction.
CVE-2025-60230 is a critical vulnerability in Themeton The Barber Shop affecting versions up to and including 1.9. It involves deserialization of untrusted data, which allows object injection. This vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation has been confirmed yet.
CVE-2025-60229 is a critical deserialization of untrusted data vulnerability in Themeton Lagom that allows object injection. It affects all versions up to and including 2.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-49108 is a critical vulnerability in park_of_ideas Moderno versions prior to 1.43. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This vulnerability allows an attacker to execute arbitrary code without any authentication, potentially leading to full system compromise. The CVSS score is 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-40757 is a high severity vulnerability in Mikado-Themes Château versions up to and including 1.2.1. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to potentially execute arbitrary code or cause a denial of service without requiring authentication.
CVE-2026-40756 is a high severity vulnerability in Mikado-Themes Zoya versions 1.4 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability allows an attacker to potentially execute arbitrary code or cause denial of service without requiring authentication.
CVE-2026-40752 is a high severity vulnerability affecting Select-Themes Manufaktur Solutions versions up to and including 1.1.1. It involves unauthenticated PHP object injection, categorized under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service without any authentication. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-40738 is a high-severity vulnerability affecting Edge-Themes Eldon versions up to and including 1.4.1. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This vulnerability allows an attacker to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.