Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,809 results · page 26 of 37

Jan 3, 2024Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.CVE-2023-49442 · Other software · Jeecg · reported by MITRECritical 9.8
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.
Product
Jeecg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lemono.fun lemono.fun
Jan 3, 2024Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary CVE-2023-51785 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9331
Product
Apache InLong
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Dec 31, 2023YITH WooCommerce Product Add-Ons: Deserialization of Untrusted DataCVE-2023-49777 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Product Add-Ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.3.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023ARI Stream Quiz – WordPress Quizzes Builder: Deserialization of Untrusted DataCVE-2023-52182 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder.This issue affects ARI Stream Quiz – WordPress Quizzes Builder: from n/a through 1.3.0.
Product
ARI Stream Quiz – WordPress Quizzes Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update ARI Stream Quiz – WordPress Quizzes Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 31, 2023Theme per user: Deserialization of Untrusted DataCVE-2023-52181 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1.
Product
Theme per user
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Theme per user to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Job Manager & Career – Manage job board listings, and recruitments: Cross-Site Request Forgery (CSRF), Deserialization of Untrusted DataCVE-2023-51545 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments.This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.
Product
Job Manager & Career – Manage job board listings, and recruitments
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Job Manager & Career – Manage job board listings, and recruitments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Deserialization of Untrusted DataCVE-2023-51505 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store.This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store : from n/a through 1.0.6.
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Rencontre – Dating Site: Deserialization of Untrusted DataCVE-2023-51470 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site.This issue affects Rencontre – Dating Site: from n/a through 3.11.1.
Product
Rencontre – Dating Site
Affected
up to 3.11.1
What to do
Affects up to 3.11.1. Update Rencontre – Dating Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Deserialization of Untrusted DataCVE-2023-51422 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition.This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: from n/a through 3.05.0.
Product
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 3.05.0
What to do
Affects up to 3.05.0. Update Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023EnvíaloSimple: Email Marketing y Newsletters: Deserialization of Untrusted DataCVE-2023-51414 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters.This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.1
What to do
Affects up to 2.1. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Zippy: Deserialization of Untrusted DataCVE-2023-36381 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.
Product
Zippy
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Zippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023Product Add-Ons: Deserialization of Untrusted DataCVE-2023-32795 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.
Product
Product Add-Ons
Affected
up to 6.1.3
What to do
Affects up to 6.1.3. Update Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 28, 2023GiveWP – Donation Plugin and Fundraising Platform: Deserialization of Untrusted DataCVE-2023-32513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 2.25.3
What to do
Affects up to 2.25.3. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 27, 2023A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed.CVE-2023-3171 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
Product
EAP 7.4.13
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Dec 21, 2023Soledad – Multipurpose, Newspaper, Blog & WooCommerce: Deserialization of Untrusted DataCVE-2023-49826 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Product
Soledad – Multipurpose, Newspaper, Blog & WooCommerce
Affected
up to 8.4.1
What to do
Affects up to 8.4.1. Update Soledad – Multipurpose, Newspaper, Blog & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Sayfa Sayac: Deserialization of Untrusted DataCVE-2023-49778 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
Product
Sayfa Sayac
Affected
up to 2.6
What to do
Affects up to 2.6. Update Sayfa Sayac to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023WoodMart - Multipurpose WooCommerce: Deserialization of Untrusted DataCVE-2023-32242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme.This issue affects WoodMart - Multipurpose WooCommerce Theme: from n/a through 1.0.36.
Product
WoodMart - Multipurpose WooCommerce
Affected
up to 1.0.36
What to do
Affects up to 1.0.36. Update WoodMart - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.CVE-2023-51656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.
Product
Apache IoTDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Dec 20, 2023File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: Deserialization of Untrusted DataCVE-2022-47599 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
Product
File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.CVE-2023-7018 · Other software · huggingface · reported by security@huntr.devHigh 7.8
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Product
huggingface/transformers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Dec 20, 2023BCorp Shortcodes: Deserialization of Untrusted DataCVE-2023-49773 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23.
Product
BCorp Shortcodes
Affected
up to 0.23
What to do
Affects up to 0.23. Update BCorp Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Genesis Simple Love: Deserialization of Untrusted DataCVE-2023-49772 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Phpbits Creative Studio Genesis Simple Love.This issue affects Genesis Simple Love: from n/a through 2.0.
Product
Genesis Simple Love
Affected
up to 2.0
What to do
Affects up to 2.0. Update Genesis Simple Love to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Gravity Forms: Deserialization of Untrusted DataCVE-2023-28782 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.
Product
Gravity Forms
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Master Slider Pro: Deserialization of Untrusted DataCVE-2023-47507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.
Product
Master Slider Pro
Affected
up to 3.6.5
What to do
Affects up to 3.6.5. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Themify Ultra: Deserialization of Untrusted DataCVE-2023-46147 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
Product
Themify Ultra
Affected
up to 7.3.5
What to do
Affects up to 7.3.5. Update Themify Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Flatsome | Multi-Purpose Responsive WooCommerce: Deserialization of Untrusted DataCVE-2023-40555 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.
Product
Flatsome | Multi-Purpose Responsive WooCommerce
Affected
up to 3.17.5
What to do
Affects up to 3.17.5. Update Flatsome | Multi-Purpose Responsive WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Deserialization of Untrusted DataCVE-2023-34382 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.19
What to do
Affects up to 3.7.19. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Recently Viewed Products: Deserialization of Untrusted DataCVE-2023-34027 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Rajnish Arora Recently Viewed Products.This issue affects Recently Viewed Products: from n/a through 1.0.0.
Product
Recently Viewed Products
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Recently Viewed Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Themesflat Addons For Elementor: Deserialization of Untrusted DataCVE-2023-37390 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
Product
Themesflat Addons For Elementor
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Themesflat Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.CVE-2023-6730 · Other software · huggingface · reported by security@huntr.devHigh 8.8
Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
Product
huggingface/transformers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Dec 18, 2023Structured Content (JSON-LD) #wpsc: Deserialization of Untrusted DataCVE-2023-49819 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023E2Pdf – Export To Pdf Tool for: Deserialization of Untrusted DataCVE-2023-46154 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.
Product
E2Pdf – Export To Pdf Tool for
Affected
up to 1.20.18
What to do
Affects up to 1.20.18. Update E2Pdf – Export To Pdf Tool for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.CVE-2023-46279 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest version, which fixes the issue.
Product
Apache Dubbo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Dec 15, 2023A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.CVE-2023-29234 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue.
Product
Apache Dubbo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Dec 5, 2023An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by aCVE-2023-46674 · Other software · Elastic · reported by security@elastic.coMedium 6
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
Product
Elasticsearch-Hadoop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.elastic.co discuss.elastic.co
Dec 4, 2023Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.CVE-2023-48967 · Other software · Noear · reported by MITRECritical 9.8
Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.
Product
Solon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 4, 2023A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service CVE-2023-6481 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chHigh 7.1
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Product
logback
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record logback.qos.ch logback.qos.ch
Dec 1, 2023A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.CVE-2023-48887 · Other software · Fengjiachun · reported by MITRECritical 9.8
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
Product
Jupiter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 1, 2023A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.CVE-2023-48886 · Other software · Luxiaoxun · reported by MITRECritical 9.8
A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
Product
Nettyrpc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 29, 2023A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending pCVE-2023-6378 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chHigh 7.1
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Product
logback
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record logback.qos.ch logback.qos.ch
Nov 20, 2023Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace functiCVE-2023-46990 · Other software · Publiccms · reported by MITRECritical 9.8
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
Product
Publiccms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44353 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44351 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Nov 17, 2023Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result inCVE-2023-44350 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Nov 9, 2023Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution.CVE-2023-47248 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Product
PyArrow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Nov 8, 2023Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA JavaCVE-2023-39913 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK.This issue affects Apache UIMA Java SDK: before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue. There are several locations in the code where serialized Java objects are deserialized without verifying the data. This affects in particular: * the deserialization of a Java-serialized CAS, but also other binary CAS formats that include TSI information using the CasIOUtils class; * the CAS Editor Eclipse plugin which uses the the CasIOUtils class to load data; * the deserialization of a Java-serialized CAS of the Vinci Analysis Engine service which can receive using Java-serialized CAS objects over network connections; * the CasAnnotationViewerApplet and the CasTreeViewerApplet; * the checkpointing feature of the CPE module. Note that the UIMA framework by default does not start any remotely accessible services (i.e. Vinci) that would be vulnerable to this issue. A user or developer would need to make an active choice to start such a service. However, users or developers may
Product
Apache UIMA Java SDK Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Nov 2, 2023Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.CVE-2023-47204 · Other software · Toumorokoshi · reported by MITRECritical 9.8
Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.
Product
Transmute-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 31, 2023Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issCVE-2023-47174 · Other software · thorntech · reported by MITRECritical 9.8
Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related issue to CVE-2016-1000027. Also, within the specific context of Thorn SFTP gateway, this leads to remote code execution.
Product
sftp_gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.thorntech.com help.thorntech.com
Oct 27, 2023In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization.CVE-2023-40121 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Oct 27, 2023Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityCVE-2023-46604 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 10
Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Product
ActiveMQ
On CISA’s list since
Nov 2, 2023 (federal fix deadline Nov 23, 2023)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org activemq.apache.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.