Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 6 of 37
Aug 12, 2026Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplCVE-2026-73325 · Other software · Fujitsu Research · reported by VulnCheckHigh 8.4
Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
- Product
- OneCompression
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiatingCVE-2026-58076 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrad
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Aug 11, 2026Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current uCVE-2026-48397 · Other software · Adobe · reported by AdobeHigh 8.6
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
- Product
- Lightroom Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-70321 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-66808 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-66805 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.CVE-2026-65815 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65665 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65663 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65658 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-64901 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-63516 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-63514 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.CVE-2026-62912 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.CVE-2026-59124 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft HPC Pack 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of priviCVE-2026-35502 · Other software · Intel · reported by secure@intel.comMedium 4.6
Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- Product
- Extension For Pytorch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remCVE-2026-17061 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 10
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
- Product
- SIMULIA Execution Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2026Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.CVE-2026-71560 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 7, 2026Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted datCVE-2026-71559 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 7, 2026Heap type confusion vulnerability in Apache Fory C++ deserialization.CVE-2026-71558 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 7, 2026Ajax Search Lite: Does not prevent the deserialization of untrusted inputCVE-2026-16258 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
- Product
- Ajax Search Lite
- Fixed in
- 4.14.5
- What to do
- Update Ajax Search Lite to 4.14.5 or newer.
Aug 6, 2026Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.CVE-2026-50515 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
- Product
- Azure Service Bus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place.CVE-2026-66909 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
- Product
- Apache CXF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 5, 2026** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.CVE-2026-61484 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Lucy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 4, 2026NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data.CVE-2026-47623 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.
- Product
- Dynamo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 4, 2026kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiateCVE-2026-69098 · Other software · Cinnamon · reported by VulnCheckCritical 9.3
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.
- Product
- kotaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 3, 2026Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection.CVE-2026-18642 · Other software · TUBITAK BILGEM Software Technologies Research Institute · reported by iletisim@usom.gov.trHigh 7.8
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
- Product
- eta-otp-lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026ChamaWP: Does not properly validate user input before passing it to a PHP deserialization functionCVE-2025-15672 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
- Product
- ChamaWP
- Fixed in
- 1.0.13
- What to do
- Update ChamaWP to 1.0.13 or newer.
Aug 2, 2026A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.CVE-2026-3245 · Other software · Canon Production Printing · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdHigh 7.7
A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.
- Product
- PRISMAproduction
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not prevent the deserialization of user-controlled input in some of its event content fieldsCVE-2026-16062 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 itself, but if one is present via another installed Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 or , this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of the Event Booking Manager for WooCommerce WordPress plugin before 5.3.7's earlier object-injection advisories.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Jul 31, 2026ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitraCVE-2026-68771 · Other software · Comfy-Org · reported by VulnCheckCritical 9.3
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.
- Product
- ComfyUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026MessagePack for Ruby is an implementation of the MessagePack binary serialization format.CVE-2026-54522 · Other software · msgpack · reported by GitHubLow 2.1
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.
- Product
- msgpack-ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database wriCVE-2026-57859 · Other software · e107inc · reported by VulnCheckHigh 7.7
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary lCVE-2026-54365 · Other software · Gladinet · reported by VulnCheckHigh 8.7
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.
- Product
- CentreStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcentrestack.comvulncheck.com
Jul 30, 2026BuddyPress: Deserialization of Untrusted DataCVE-2026-1360 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
- Product
- BuddyPress
- Affected
- up to 14.5.0
- What to do
- Affects up to 14.5.0. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordowasp.orgplugins.trac.wordpress.org
Jul 28, 2026IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted CVE-2026-14974 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypaCVE-2026-14512 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache CVE-2026-66713 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code via a crafted serialized Java object delivered to the cluster channel and deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are recommended to upgrade to version 2.0.1, which fixes this issue by removing the clustering feature entirely.
- Product
- Apache Axis2/Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Jul 28, 2026A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPCVE-2026-11756 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comCritical 10
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
- Product
- Station Launcher App in 3DEXPERIENCE platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under CVE-2026-65617 · Other software · jfrog · reported by reefs@jfrog.comHigh 8.8
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Jul 27, 2026JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityCVE-2026-63077 · Other software · JetBrains · reported by cve@jetbrains.comExploitedRansomwareCritical 9.8
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.
- Product
- TeamCity
- On CISA’s list since
- Aug 5, 2026 (federal fix deadline Aug 8, 2026)
- What to do
- Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogjetbrains.comcisa.gov
Jul 27, 2026Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (craCVE-2026-17572 · Other software · The HDF Group · reported by 0253b833-3e77-4dfe-9d57-17db1a2f0a74Medium 5.5
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.
- Product
- HDF5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.CVE-2026-50517 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application ServeCVE-2026-21655 · Other software · Johnson Control · reported by productsecurity@jci.comHigh 8.7
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
- Product
- victor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrustCVE-2026-15037 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Low 2.9
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.org
Jul 22, 2026Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents beingCVE-2026-13066 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.1
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
- Product
- MongoDB Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacCVE-2026-13190 · Other software · Progress Software · reported by security@progress.comHigh 8.1
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
- Product
- Telerik UI for ASP.NET AJAX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data.CVE-2026-24232 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.3
NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- Tranformers4Rec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Jul 21, 2026Use After Free vulnerability in the Rust deserialization logic of Apache Fory.CVE-2026-60080 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 21, 2026Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization.CVE-2026-64606 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
- Product
- Apache Fory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.