Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jul 23, 2026A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83.CVE-2026-16723 · Other software · Alibaba · reported by alibaba-cna@list.alibaba-inc.comCritical 9
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may beCVE-2025-70974 · Other software · Alibaba · reported by MITRECritical 10
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability.CVE-2025-63617 · Other software · Kutangguo · reported by MITREMedium 6.5
ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deserializes unsafe input data.
- Product
- Ktg-mes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 8, 2025A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.CVE-2025-60834 · Other software · Ghostxbh · reported by MITREMedium 6.5
A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.
- Product
- Uzy-ssm-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 8, 2025WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.CVE-2025-60828 · Other software · 5kcrm · reported by MITREMedium 6.5
WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.
- Product
- Wukong CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.CVE-2024-57766 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.CVE-2024-57764 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.CVE-2024-57763 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.CVE-2024-29433 · Other software · alldata · reported by MITRECritical 9.8
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.
- Product
- alldata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 28, 2024An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson CVE-2024-23052 · Other software · wukongopensource · reported by MITRECritical 9.8
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
- Product
- wukongcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whicCVE-2022-25845 · Other software · Alibaba · reported by report@snyk.ioHigh 8.1
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a craCVE-2017-18349 · Other software · Alibaba · reported by MITRECritical 9.8
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
- Product
- Fastjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.