CVE-2026-78162 is a critical deserialization of untrusted data vulnerability in Apache Camel affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw arises because certain Hazelcast instances created internally by Camel do not apply Java deserialization filters, allowing an attacker with access to the Hazelcast cluster to cause arbitrary Java objects to be deserialized. This can lead to remote code execution. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1, and users are strongly advised to upgrade. Alternative mitigations include supplying explicit Hazelcast configurations with deserialization filters, injecting pre-built Hazelcast instances, setting JVM-wide serialization filters, and enabling Hazelcast cluster authentication and TLS.
CVE-2026-81344 is a deserialization vulnerability in the ACF Frontend Admin by DynamiApps WordPress plugin up to version 3.29.13. It allows high-privilege users, such as administrators, to inject PHP objects during deserialization of stored post content rendered on public pages. This can potentially lead to remote code execution if a suitable gadget chain exists in the plugin or WordPress core.
LearnPress WordPress plugin versions up to 4.4.10 are vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' parameter during checkout AJAX requests. The plugin improperly unserializes data without restricting allowed classes, enabling unauthenticated attackers to inject malicious PHP objects. This vulnerability has a critical severity with a CVSS score of 9.8.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin up to version 6.3.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. This vulnerability allows authenticated users with at least Editor-level privileges to inject PHP objects. Exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme, which could lead to arbitrary file deletion, data disclosure, or code execution. Without such a POP chain, the vulnerability has no direct impact.
Apache Kylin versions 4.0.0 through 5.0.4 contain a critical deserialization of untrusted data vulnerability (CWE-502) that arises from unsafe Java deserialization via a broken external cache service. This vulnerability allows remote attackers to execute arbitrary code without authentication. The issue is fixed in Apache Kylin version 5.0.5.
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.
The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code.
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim to run a crafted image can bypass WebAssembly validation and execute native code in the shim zygote process, gaining the filesystem, environment, credentials, networking, and Linux syscall access available to the workload container. Downstream shims built with runwasi's containerd-shim-wasm precompile-cache API are also affected if they implement Compiler and trust executable precompiled artifacts from OCI image layers; the 0.6.1 boundary applies specifically to containerd-shim-wasmtime and does not independently certify downstream product releases. The flaw escapes the WASI sandbox to the workload container boundary, but it does not by itself bypass container isolation or provide direct host code execution. This issue is fixed in version 0.6.1.
CVE-2026-110812 is a critical vulnerability in the Amazon Neptune engine's Gremlin graph data import component. It involves deserialization of untrusted data, which could allow an authenticated remote user with standard database permissions to execute arbitrary code and access internal service credentials. The issue affects versions from 1.2.0.0 up to but not including 1.5.0.0. AWS has released a fixed version 1.5.0.0 and backported fixes to 1.4.8.1 and 1.4.7.1. Users not enrolled in auto-update should upgrade to these versions to remediate the vulnerability.
CVE-2026-111094 is a high-severity vulnerability in JetBrains TeamCity that allows remote code execution due to a whitelist bypass in the build messages protocol. It affects versions prior to 2026.2, 2026.1.4, and 2025.11.8. The vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data).
EspoCRM versions prior to 9.3.7 contain a critical deserialization vulnerability (CWE-502) that allows an authenticated administrator to supply crafted serialized PHP object data. This data is stored in background MassAction or Export parameters and later deserialized without restricting allowed classes, enabling attacker-controlled object instantiation and arbitrary code execution on the server. The issue is fixed in version 9.3.7.
Red Hat AI Inference 3.4.6 (cpu) is the subject of a security advisory issued by Red Hat Product Security. The advisory lists multiple CVEs including CVE-2026-15679 and others, but does not provide specific technical details or affected versions. No fixes or patches are currently indicated in the advisory.
CVE-2026-55573 is a critical deserialization vulnerability in the e107 content management system prior to version 2.3.7. The vulnerability exists in install.php, which unserializes attacker-controlled data without restricting allowed classes, enabling unauthenticated remote code execution. This flaw allows an attacker to execute arbitrary PHP functions with the web server's privileges, potentially leading to full server compromise. The issue is fixed in version 2.3.7.
CVE-2026-73793 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop Middleware involving deserialization of untrusted data and secret key handling issues. It allows an attacker with high privileges to potentially impact confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 score of 7.9, indicating significant risk. No affected versions or patch information are provided in the available data.
The Post Export Import with Media WordPress plugin up to version 1.17.1 is vulnerable to PHP Object Injection via deserialization of untrusted data. This vulnerability requires an attacker to have administrator-level access. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain exists, attackers may delete files, access sensitive data, or execute code.
CVE-2026-65674 is a high-severity vulnerability in Microsoft SQL Server 2019 (GDR) involving deserialization of untrusted data. An authorized attacker can exploit this flaw over a network to execute arbitrary code. Multiple affected version ranges exist, with official fixes released by Microsoft.
IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a vulnerability related to deserialization of untrusted data. This flaw allows an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability has a high severity with a CVSS score of 8.2, indicating significant impact on integrity and some impact on availability.
CVE-2026-105442 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.10. It involves insecure deserialization of untrusted data in the messaging service, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.