Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 11 of 37
Mar 24, 2026NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data.CVE-2025-33244 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9
NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, data tampering, and information disclosure.
- Product
- Apex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Mar 24, 2026Deserialization of Untrusted Data vulnerability in DTStack chunjun (chunjun-core/src/main/java/com/dtstack/chunjun/util modules).CVE-2026-4735 · Other software · DTStack · reported by cve_disclosure@tech.gov.sgHigh 8.7
Deserialization of Untrusted Data vulnerability in DTStack chunjun (chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java. This issue affects chunjun: before 1.16.1.
- Product
- chunjun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format.CVE-2026-26209 · Other software · agronholm · reported by GitHubHigh 7.5
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the wo
- Product
- cbor2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026TotalContest Lite: Deserialization of Untrusted DataCVE-2026-0677 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite: from n/a through <= 2.9.1.
- Product
- TotalContest Lite
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update TotalContest Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlingCVE-2025-71260 · Other software · BMC Software, Inc. · reported by VulnCheckHigh 8.7
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
- Product
- FootPrints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.bmc.comlabs.watchtowr.com
Mar 19, 2026WishList Member X: Deserialization of Untrusted DataCVE-2026-25445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.
- Product
- WishList Member X
- Affected
- up to 3.29.0
- What to do
- Affects up to 3.29.0. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Finag: Deserialization of Untrusted DataCVE-2025-60237 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
- Product
- Finag
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Finag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Zuut: Deserialization of Untrusted DataCVE-2025-60233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
- Product
- Zuut
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Zuut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026ColorFolio - Freelance Designer: Deserialization of Untrusted DataCVE-2026-27096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
- Product
- ColorFolio - Freelance Designer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ColorFolio - Freelance Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2026Traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
- Product
- JetEngine
- What to do
- Update JetEngine to the newest version.
Mar 12, 2026SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization.CVE-2026-3989 · Other software · SGLang · reported by cret@cert.orgHigh 7.8
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
- Product
- SGLang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-26114 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.CVE-2026-25166 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.
- Product
- Windows ADK for Windows 10, version 2004
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on worCVE-2026-1286 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.
- Product
- EcoStruxure™ Foxboro DCS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Mar 10, 2026A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.CVE-2025-56422 · Other software · Limesurvey · reported by MITRECritical 9.8
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authentiCVE-2025-11739 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Mar 10, 2026SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could resulCVE-2026-27685 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.
- Product
- SAP NetWeaver Enterprise Portal Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component.CVE-2026-27749 · Other software · Gen Digital Inc. · reported by security@nortonlifelock.comHigh 7.8
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.
- Product
- Avira Internet Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.avira.comavira.com
Mar 5, 2026Good Energy: Deserialization of Untrusted DataCVE-2026-28105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
- Product
- Good Energy
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update Good Energy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Pizza House: Deserialization of Untrusted DataCVE-2026-28074 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
- Product
- Pizza House
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Pizza House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Dentario: Deserialization of Untrusted DataCVE-2026-27439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
- Product
- Dentario
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Dentario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Kingler: Deserialization of Untrusted DataCVE-2026-27438 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
- Product
- Kingler
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Kingler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Tennis Club: Deserialization of Untrusted DataCVE-2026-27437 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.
- Product
- Tennis Club
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Tennis Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Sweet Date: Deserialization of Untrusted DataCVE-2026-27417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.
- Product
- Sweet Date
- What to do
- Update Sweet Date to the newest version.
Mar 5, 2026NextScripts: Deserialization of Untrusted DataCVE-2026-27379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
- Product
- NextScripts
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update NextScripts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Celeste: Deserialization of Untrusted DataCVE-2026-27369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.
- Product
- Celeste
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Celeste to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Car Zone: Deserialization of Untrusted DataCVE-2026-27338 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
- Product
- Car Zone
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Car Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Au Pair Agency - Babysitting & Nanny: Deserialization of Untrusted DataCVE-2026-27098 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.
- Product
- Au Pair Agency - Babysitting & Nanny
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Au Pair Agency - Babysitting & Nanny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Podlove Web Player: Deserialization of Untrusted DataCVE-2026-24385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web Player: from n/a through <= 5.9.1.
- Product
- Podlove Web Player
- Affected
- up to 5.9.1
- What to do
- Affects up to 5.9.1. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026PowerPress Podcasting: Deserialization of Untrusted DataCVE-2026-23798 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.
- Product
- PowerPress Podcasting
- Affected
- up to 11.15.10
- What to do
- Affects up to 11.15.10. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Mounthood: Deserialization of Untrusted DataCVE-2026-22501 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.
- Product
- Mounthood
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Mounthood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Jardi: Deserialization of Untrusted DataCVE-2026-22497 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.
- Product
- Jardi
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Jardi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Estate: Deserialization of Untrusted DataCVE-2026-22475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.
- Product
- Estate
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Equestrian Centre: Deserialization of Untrusted DataCVE-2026-22474 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.
- Product
- Equestrian Centre
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Equestrian Centre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Dental Clinic: Deserialization of Untrusted DataCVE-2026-22473 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
- Product
- Dental Clinic
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Dental Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Secudeal Payments for Ecommerce: Deserialization of Untrusted DataCVE-2026-22471 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.
- Product
- Secudeal Payments for Ecommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Secudeal Payments for Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Solaris: Deserialization of Untrusted DataCVE-2026-22454 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
- Product
- Solaris
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Solaris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Pets Club: Deserialization of Untrusted DataCVE-2026-22453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
- Product
- Pets Club
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Pets Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Handyman: Deserialization of Untrusted DataCVE-2026-22451 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
- Product
- Handyman
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Grand Wedding: Deserialization of Untrusted DataCVE-2026-22417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
- Product
- Grand Wedding
- What to do
- Update Grand Wedding to the newest version.
Mar 5, 2026Classter: Deserialization of Untrusted DataCVE-2025-54001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
- Product
- Classter
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Classter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2026Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityCVE-2026-20131 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedRansomwareCritical 10
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
- Product
- Secure Firewall Management Center (FMC)
- On CISA’s list since
- Mar 19, 2026 (federal fix deadline Mar 22, 2026)
- What to do
- Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsec.cloudapps.cisco.comaws.amazon.com
Mar 2, 2026U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on thCVE-2026-3422 · Other software · e-Excellence · reported by twcert@cert.org.twCritical 9.3
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 27, 2026Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang CVE-2026-21619 · Other software · hexpm · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbLow 2
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4. This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
- Product
- hex_core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Feb 27, 2026IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue.CVE-2026-27776 · Other software · NTT DATA INTRAMART Corporation · reported by vultures@jpcert.or.jpHigh 8.6
IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege.
- Product
- intra-mart Accel Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.intra-mart.supportjvn.jp
Feb 26, 2026In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phasCVE-2026-28364 · Other software · OCaml · reported by MITREHigh 7.9
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
- Product
- OCaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a maCVE-2026-3071 · Other software · Flair · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.4
Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.
- Product
- Flair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhiddenlayer.comhiddenlayer.com
Feb 26, 2026uListing: Deserialization of Untrusted DataCVE-2026-28138 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
- Product
- uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 23, 2026Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.CVE-2026-25747 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
- Product
- Apache Camel LevelDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.