IBM WebSphere Application Server versions 8.5 and 9.0 contain a vulnerability in the SAML Web Single Sign-On component where improper validation of user-supplied data during deserialization can lead to remote code execution. This occurs when a crafted HTTP request is combined with a suitable gadget chain. The vulnerability is tracked as CVE-2026-9330 and has a high severity score of 8.5. No official patch or remediation guidance has been provided yet by IBM. There are no known exploits in the wild at this time.
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.
CVE-2026-10532 is a deserialization of untrusted data vulnerability in the logback-core component of QOS.CH Sarl's logback library, specifically in the HardenedObjectInputStream module. It allows an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects, bypassing intended security restrictions. The vulnerability affects logback versions from 0 up to and including 1.5.33. No practical remote code execution or significant privilege escalation has been identified. The severity is rated low with a CVSS score of 2.9.
A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names (e.g. `return_value`) that the matching POST endpoint already validated against `FORBIDDEN_XCOM_KEYS`. The endpoint also accepted serialized payload shapes the triggerer's deserializer treats as code; combined, this allowed RCE on the triggerer when the affected task next deferred. Affects deployments where untrusted users have XCom write permission on Dags that defer to the triggerer. This is a fix-bypass of CVE-2026-33858: PR #64148 added the `FORBIDDEN_XCOM_KEYS` validator only on the POST/set path; the PATCH path was not covered. Users who already upgraded for CVE-2026-33858 should additionally upgrade to `apache-airflow` 3.2.2 or later to cover the PATCH-path bypass.
Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler — the default on single-host deployments where the DAG bundle is importable from the scheduler process — could embed a custom `DeadlineReference` whose serialized form named an attacker-controlled module path, causing the scheduler to `import_string(...)` and instantiate that class with a live SQLAlchemy session attached. Affects deployments where DAG-author code is less trusted than the scheduler process. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticated remote code execution.
manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.
The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present within the vulnerable plugin itself, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVE-2026-9828 is a low-severity deserialization vulnerability in QOS.CH Sarl's logback-core module affecting versions prior to 1.5.33. It involves the HardenedObjectInputStream component, where an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate certain java.lang and java.util objects that are not explicitly blocked. Despite this, the deserialization restrictions are strong, and no practical remote code execution or significant privilege escalation has been identified.
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization. This vulnerability is fixed in LangSmith SDK Python 0.8.0 and JS/TS 0.6.0.
RELATE, a web-based courseware package by inducer, had a vulnerability prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb where its Celery workers accepted and deserialized untrusted pickle data. This flaw allowed an attacker with access to the message broker to execute arbitrary commands on the host server. Additionally, the lack of network isolation in the code execution sandbox enabled an authenticated student to achieve full remote code execution (RCE) on the host system. The issue was fixed in the specified commit.
LangChain versions prior to 0.3.85 and between 1.0.0a1 and before 1.3.3 contain a deserialization vulnerability. The framework uses overly broad allowlists when deserializing certain runtime inputs, allowing trusted LangChain-serializable objects to be instantiated with untrusted constructor arguments. This can lead to unintended object instantiation during deserialization. The vulnerability is identified as CWE-502 and has a high severity with a CVSS score of 8.
NVIDIA Merlin Transformers4Rec for Linux contains a deserialization vulnerability (CWE-502) that improperly handles untrusted data. This vulnerability affects all versions prior to March 11, 2026. Exploitation could result in code execution, data tampering, and information disclosure. The vulnerability has a high severity CVSS score of 7.8. No official patch or remediation guidance has been provided by NVIDIA at this time. There are no known exploits reported in the wild.
CVE-2026-9291 is a high-severity vulnerability in the Amazon Braket Python SDK before version 1.117.0. It involves insecure deserialization in the job results processing component, which could allow a remote authenticated user with S3 write access to the job output bucket to execute arbitrary code on any machine processing job results. AWS has released version 1.117.0 to address this issue.
Apache Fory versions before 1.0.0 contain a critical deserialization vulnerability (CWE-502) in the PyFory ReduceSerializer. This vulnerability allows bypassing of DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when using Python-native mode with strict mode disabled. Exploitation requires deserializing attacker-controlled data under these conditions. Upgrading to Apache Fory 1.0.0 or later mitigates the issue by enforcing DeserializationPolicy validation.