CWE-502: Deserialization of Untrusted Data vulnerabilities

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

CVE-2026-24228 is a high-severity vulnerability in the NVIDIA NeMo Framework for Linux involving deserialization of untrusted data. Exploitation could allow an attacker with local access and low privileges to execute arbitrary code, escalate privileges, tamper with data, and disclose sensitive information. The vulnerability does not require user interaction but has limited attack vector scope (local). No patch or remediation details are currently provided.

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.binary_to_term/1 on the raw gRPC message body without the :safe option, no size bound, and no type guard. Any unauthenticated peer that sends a request with Content-Type: application/grpc+erlpack can send a crafted payload that mints arbitrary new atoms (which are never garbage-collected, exhausting the bounded atom table and crashing the VM) or that encodes a fun term which, if applied anywhere downstream, executes attacker-controlled code inside the server process. This issue affects grpc: from 0.4.0 before 1.0.0.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

CVE-2026-49769 is a critical vulnerability in wpForo Forum versions up to and including 3.1.0. It allows unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability has a very high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. Exploits are not known to be in the wild at this time.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

CVE-2026-49109 is a critical vulnerability involving unauthenticated PHP object injection in the crm perks Integration plugin for Salesforce and popular WordPress form plugins including Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms. This affects versions up to and including 1.4.3. The vulnerability allows remote attackers to perform deserialization of untrusted data, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating critical severity. The affected product is a cloud service, and a patch is available.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.