CVE-2026-105013 is a deserialization vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to execute code remotely over a network. The flaw affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190 to address this issue. The vulnerability has a high severity rating with a CVSS score of 7.4. There are no known exploits in the wild at this time.
CVE-2026-100214 is a high-severity vulnerability in Microsoft Dynamics NAV 2017 involving deserialization of untrusted data. This flaw allows an authorized attacker to execute arbitrary code remotely over a network. The vulnerability affects versions prior to build 30713 and version 11.0.50736.0. An official fix is available from Microsoft.
CVE-2026-83520 is a high-severity vulnerability in the Microsoft .NET 10.0 runtime involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute code remotely by exploiting unsafe deserialization. Multiple versions of the .NET runtime prior to specific fixed releases are affected. An official fix is available from Microsoft.
CVE-2026-70035 is a high-severity vulnerability in the Microsoft .NET 10.0 runtime involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute code remotely over a network. Multiple versions of the .NET runtime are affected, but official fixes have been released for all impacted versions. The vulnerability requires user interaction to exploit and has a CVSS score of 8.8.
CVE-2026-96186 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving deserialization of untrusted data in the Windows Media Foundation component. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Official patches are available from Microsoft to address this issue.
CVE-2026-87692 is a vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23 involving deserialization of untrusted data. This flaw allows an authorized attacker to perform local privilege escalation. The vulnerability has a high severity rating with a CVSS score of 7.8. Fixed versions have been released by Microsoft.
CVE-2026-85900 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving deserialization of untrusted data. An authorized attacker can exploit this flaw to execute arbitrary code remotely over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190 to address this issue.
CVE-2026-87697 is a high-severity vulnerability in Microsoft .NET 10.0 runtime involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple .NET runtime versions prior to their respective fixed releases. Official patches have been released to address the issue.
CVE-2026-88091 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where deserialization of untrusted data in Windows Management Instrumentation allows an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 builds prior to specific fixed versions. A high-severity CVSS 3.1 score of 7.8 reflects the potential for complete confidentiality, integrity, and availability impact. Microsoft has released official fixes for all affected versions.
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVE-2026-12613 is a high-severity vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor affecting Windows, Linux, and MacOS versions prior to 5.4.20 and 5.4.21. It involves deserialization of untrusted data, which allows object injection. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No explicit patch or remediation details are provided in the available data.
CVE-2026-81797 is a critical vulnerability in the ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme version 1.0.2 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-78535 is a critical vulnerability in ThemeRex Photolia versions up to 1.0.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-78533 is a critical vulnerability in AncoraThemes Qwery versions up to and including 3.6.1. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.
CVE-2026-78531 is a critical vulnerability in ThemeREX Jacqueline versions up to 2.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.
CVE-2026-78529 is a critical vulnerability in ThemeREX Alliance versions up to and including 3.11. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.
CVE-2026-66569 is a critical vulnerability in axiomthemes Kicker versions up to 2.2.1 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.
CVE-2026-66568 is a critical vulnerability in axiomthemes Original versions up to 1.9.0 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-66567 is a critical vulnerability in AncoraThemes Anesta versions up to 1.5.3 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.