By weakness (CWE)

CWE-502: related vulnerabilities

CVEs classified under CWE-502. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

115 published vulnerabilities · page 1 of 2

• CVE-2025-11993HIGH 8.8

  The WooCommerce Infinite Scroll and Ajax Pagination plugin contains a security flaw that allows authenticated WordPress users (including low-privilege subscribers) to inject malicious PHP objects through the plugin's import settings feature. While the plugin itself doesn't provide a direct attack path, if other plugins or themes on the same WordPress installation have known gadget chains, an attacker could exploit this vulnerability to delete files, steal data, or run arbitrary code. The vulnerability affects all versions up to and including 1.8.

• CVE-2025-69130HIGH 8.8

  A PHP Object Injection vulnerability exists in the Entrepreneur - Booking for Small Businesses WordPress theme in versions 3.1.3 and earlier. An authenticated user with minimal privileges can inject malicious serialized PHP objects into the subscriber functionality, potentially leading to remote code execution. This is particularly dangerous because the attack requires only user-level access—not administrator rights—making it exploitable by subscribers or low-privilege contributors on affected WordPress installations.

• CVE-2026-14534HIGH 8.8

  Fickling, a Python library designed to detect malicious pickle payloads before they execute, fails to block code execution via three standard library modules: _posixsubprocess, site, and atexit. An attacker can craft a specially formatted pickle file that exploits these blind spots, causing fickling's safety check to incorrectly report the payload as safe. When a developer uses fickling to load the pickle, the malicious code runs anyway. This is particularly dangerous because fickling is explicitly marketed as a security gate, so users trust its verdicts.

• CVE-2026-20251HIGH 8.8

  A vulnerability in Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway allows low-privileged users without admin or power roles to execute arbitrary code remotely. The flaw stems from unsafe deserialization of data stored in Splunk's KV Store (key-value store) component. An attacker only needs basic user credentials to potentially compromise the entire Splunk environment. This is a serious issue because privilege escalation to code execution typically requires administrative access; this vulnerability bypasses that requirement entirely.

• CVE-2026-27060HIGH 8.8

  ARMember Premium versions before 7.6 contain a deserialization vulnerability that allows authenticated users to inject malicious objects into the application. An attacker with valid login credentials can exploit this flaw to execute arbitrary code, access sensitive data, or disrupt service availability. The vulnerability requires authentication but poses significant risk because it grants full system compromise once exploited.

• CVE-2026-39478HIGH 8.8

  A PHP Object Injection vulnerability has been discovered in the Anti-Malware Security and Brute-Force Firewall plugin affecting versions up to and including 4.23.87. This flaw allows authenticated users with contributor-level permissions to inject malicious PHP objects, potentially leading to unauthorized code execution, data theft, or system compromise. The vulnerability requires login access but does not need user interaction once authenticated, making it a credible risk in multi-user or compromised-account scenarios.

• CVE-2026-39532HIGH 8.8

  A PHP object injection flaw exists in the Events Calendar extension for GeoDirectory that allows authenticated users to inject malicious serialized PHP objects. When these objects are deserialized by the application, they can trigger unintended code execution with the privileges of the web server. This vulnerability affects GeoDirectory versions 2.3.25 and earlier. An attacker who has gained contributor-level access (or higher) to the WordPress site can exploit this without user interaction to fully compromise the system.

• CVE-2026-41862HIGH 8.8

  Spring Statemachine versions 3.2.0–3.2.4 and 4.0.0–4.0.1 contain a critical flaw in how they store and restore application state using Kryo serialization. When applications use JPA, MongoDB, Redis, or ZooKeeper backends to persist state-machine contexts, the framework deserializes that data without validating which classes are allowed to be reconstructed. An attacker with valid application credentials can craft malicious serialized payloads that, when restored, execute arbitrary code within the application's Java process. This is a classic unsafe deserialization vulnerability that treats any persisted data as trustworthy.

• CVE-2026-42359HIGH 8.8

  Apache Airflow contains a bypass of an earlier security fix that allows authenticated users with restricted permissions to inject malicious code into deferred tasks. An attacker with legitimate write access to task metadata can craft a specially formatted request to set hidden configuration values that trigger remote code execution when the task resumes. This affects organizations where any untrusted team members have editing permissions on Airflow workflows.

• CVE-2026-45484HIGH 8.8

  A flaw in Microsoft SharePoint Server allows an authenticated attacker to bypass normal access controls and gain elevated privileges on the system. The vulnerability stems from improper handling of serialized data—specifically, the application accepts and processes untrusted serialized objects without adequate validation. An attacker with valid SharePoint credentials can craft malicious serialized payloads that execute with higher privileges when deserialized, effectively escalating their access level within the SharePoint environment.

• CVE-2026-46590HIGH 8.8

  Apache Camel's post-quantum cryptography (PQC) component has a critical flaw in how it handles cryptographic key metadata. When key managers like HashiCorp Vault or AWS Secrets Manager retrieve stored keys, they deserialize data using an unsafe Java deserialization method without any validation. An attacker who can write to the backend storage system (Vault or AWS Secrets Manager) can inject a malicious serialized object that executes arbitrary code when the application deserializes it during normal key operations. This is particularly dangerous because the vulnerability persists from an earlier incomplete fix and affects three different key storage implementations.

• CVE-2026-52751HIGH 8.8

  Ghidra, the NSA's open-source reverse-engineering toolkit, contains a critical flaw in how it handles project files shared over its network protocol. When you open a malicious project file (identified by a ghidra:// link), the application deserializes untrusted data without proper validation. An attacker can exploit this to run arbitrary commands on your machine with the privileges of your Ghidra process. The vulnerability affects all versions before 12.1 and requires only that a user click to open a file—no special authentication or configuration is needed.

• CVE-2026-53435HIGH 8.8

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a critical flaw in how they process configuration files. An authenticated attacker can craft a malicious `config.xml` file that causes Jenkins to deserialize and instantiate arbitrary Java objects from Jenkins core or installed plugins. Once deserialized, these objects can intercept and handle HTTP requests, enabling the attacker to impersonate any Jenkins user—including administrators—and perform actions such as accessing the Script Console to execute arbitrary code or reading sensitive files from the Jenkins controller.

• CVE-2026-54469HIGH 8.8

  Dell Unisphere for PowerMax versions 10.3.0.5 and earlier contain a flaw that allows a low-privileged attacker with remote access to execute arbitrary commands as root. The vulnerability stems from unsafe handling of serialized data, meaning an attacker can craft malicious input that, when deserialized by the application, triggers code execution at the highest privilege level. This is a critical escalation path: an attacker who gains even basic user access can weaponize this flaw to take complete control of the storage management infrastructure.

• CVE-2026-56037HIGH 8.8

  Themify Popup versions through 1.4.3 contain a deserialization vulnerability that allows authenticated attackers to inject malicious objects into the application. An attacker with user credentials can craft a specially formatted request that causes the plugin to deserialize untrusted data, leading to arbitrary code execution and full system compromise. This is a high-severity flaw requiring immediate patching.

• CVE-2026-57516HIGH 8.8

  Ray versions before 2.56.0 contain a critical vulnerability in how they process web dataset files. When using the read_webdataset() function, Ray automatically unpacks and deserializes certain file types (pickle and PyTorch model files) from tar archives without validation. An attacker can craft a malicious archive containing specially crafted .pkl, .pickle, .pt, or .pth files that execute arbitrary code when processed. Because Ray distributes this work across remote workers, the malicious code runs on every worker that touches the archive, potentially compromising your entire distributed computing cluster.

• CVE-2026-57527HIGH 8.8

  Zed Attack Proxy (ZAP), a widely-used security testing tool, contains a critical vulnerability in its ViewState add-on that allows attackers to run arbitrary code on a security analyst's machine. The flaw exists because the add-on deserializes untrusted data from web server responses without proper validation. An attacker who controls or compromises a proxied web server can craft a malicious response that executes code within ZAP itself when an analyst uses the tool to inspect the response. This is particularly concerning because ZAP is trusted to test web applications—turning it into an attack vector undermines that trust.

• CVE-2026-7654HIGH 8.8

  The Admin Columns plugin for WordPress contains a critical flaw that allows authenticated users—including those with basic contributor permissions—to execute arbitrary code on a website. The vulnerability stems from insecure handling of serialized PHP data in post metadata. An attacker with contributor-level access or higher can craft a malicious serialized object and inject it into a post's custom field, triggering code execution with the privileges of the web server. This affects all versions up to and including 7.0.18.

• CVE-2026-8365HIGH 8.8

  The Blocksy WordPress theme contains a critical flaw that allows authenticated users with contributor-level permissions (or higher) to execute arbitrary code on affected websites. The vulnerability stems from two weaknesses: the theme's REST API endpoint accepts serialized PHP objects without proper validation, and the database migration process automatically deserializes these objects without safety restrictions. An attacker with contributor access can craft a malicious object that triggers unintended code execution when the site is upgraded, effectively giving them full control over the website.

• CVE-2026-9330HIGH 8.5

  IBM WebSphere Application Server versions 8.5 and 9.0 contain a flaw in how they validate incoming data during user authentication via SAML (Security Assertion Markup Language) web single sign-on. An attacker with valid login credentials can send a specially crafted request that, when processed through a vulnerable deserialization pathway, may execute arbitrary code on the server. This risk is elevated because it requires only basic authentication and can impact systems across an organization's trust boundary.

• CVE-2026-14637HIGH 8.2

  A critical flaw has been discovered in the Ecommerce-CodeIgniter-Bootstrap project that allows attackers to remotely execute arbitrary code by manipulating how the shopping cart data is processed. The vulnerability exploits unsafe deserialization—a process where untrusted data is converted back into executable objects without proper validation. An attacker can send a specially crafted shopping cart parameter to trigger this flaw, potentially compromising the application and any data it handles. The exploit details have already been made public, making this an active threat.

• CVE-2025-71339HIGH 8.1

  Picklescan is a Python security tool designed to scan pickle files for malicious content before they're loaded. A flaw in versions before 0.0.33 allows attackers to bypass this protection by using a specific Python gadget chain involving numpy's f2py module. An attacker can craft a malicious pickle file that appears safe to Picklescan but executes arbitrary code when the file is actually loaded, defeating the tool's core purpose of preventing pickle-based code execution attacks.

• CVE-2025-71340HIGH 8.1

  Picklescan is a security tool designed to detect malicious code embedded in pickle files—Python's serialization format commonly used for saving machine learning models and other objects. Versions 0.0.26 and earlier have a detection gap: they fail to catch a specific evasion technique where attackers hide arbitrary code execution within the `__reduce__` method by invoking `idlelib.pyshell.ModifiedInterpreter.runcode`. When a compromised pickle file is loaded into memory, this hidden code executes silently, giving attackers a pathway to inject malicious logic into supply chains that distribute pre-trained PyTorch models or other Python-based artifacts. The vulnerability is patched in version 0.0.30.

• CVE-2025-71341HIGH 8.1

  Picklescan, a tool designed to scan Python pickle files for malicious code, has a detection bypass vulnerability in versions before 0.0.29. An attacker can craft a malicious pickle file that uses the profile.Profile.runctx function in a way that picklescan fails to detect, allowing arbitrary code execution when the file is unpickled. This is particularly dangerous because picklescan is often relied upon as a security control to prevent exactly this kind of attack.

• CVE-2025-71342HIGH 8.1

  A security detection tool called picklescan has a blind spot that allows attackers to hide malicious code in Python pickle files. Pickle is a serialization format widely used in machine learning frameworks like PyTorch. When someone opens a booby-trapped pickle file with standard Python code, the hidden malicious instructions execute automatically, giving the attacker remote code execution. Because picklescan versions before 0.0.30 miss this specific attack pattern—using a Python module called idlelib.run.Executive—the tool cannot warn users that a pickle file is dangerous, making it an effective supply chain weapon against organizations that rely on pre-trained ML models from untrusted sources.

• CVE-2025-71343HIGH 8.1

  picklescan, a security tool designed to detect malicious pickle files before they're loaded, contains a detection bypass in versions before 0.0.30. Attackers can craft specially constructed pickle files that exploit a function in Python's lib2to3 library to execute arbitrary code while evading picklescan's safety checks. The vulnerability is triggered when a user or application calls pickle.load() on a crafted malicious file, making it a supply-chain and deserialization risk for organizations relying on picklescan for protection.

• CVE-2025-71344HIGH 8.1

  picklescan is a security scanning tool designed to detect malicious code hidden in pickle files before they're loaded by Python applications. However, versions 0.0.26 and earlier have a critical blind spot: they fail to recognize the ensurepip._run_pip function when embedded in pickle files. Attackers can exploit this gap by crafting malicious pickle files that call ensurepip._run_pip through __reduce__ methods—a standard pickle deserialization hook. When an application using vulnerable picklescan loads such a file, the malicious code executes without triggering any security alert, giving attackers arbitrary code execution on the system.

• CVE-2025-71345HIGH 8.1

  Picklescan is a security tool designed to detect and block malicious Python pickle files before they are deserialized. A gap has been discovered in versions prior to 0.0.30: the tool fails to identify pickle files that exploit the torch.utils.bottleneck.__main__.run_autograd_prof function, a PyTorch utility typically used for performance profiling. Attackers can weaponize this oversight by embedding code in pickle files that executes when the file is unpickled, potentially leading to remote code execution on systems that use picklescan as their defense mechanism. This is particularly dangerous because organizations relying on picklescan may believe they are protected when they are not.

• CVE-2025-71347HIGH 8.1

  Picklescan, a Python security tool designed to detect malicious code in pickle files before they're loaded, has a gap in its detection logic. Versions before 0.0.33 miss a specific attack technique that uses NumPy's internal fortran parsing code (numpy.f2py.crackfortran.param_eval) hidden in pickle serialization instructions. An attacker can craft a pickle file that runs arbitrary code when an application deserializes it—and picklescan won't flag it as dangerous. This means if your organization relies on picklescan to safely handle untrusted pickle data, you need to update immediately.

• CVE-2025-71348HIGH 8.1

  A vulnerability in picklescan, a Python library designed to detect malicious pickle files, allows attackers to bypass its safety checks by embedding code that specifically leverages torch.utils._config_module.load_config within pickle reduce methods. When an unsuspecting user loads such a crafted pickle file, the embedded code executes as if the file were benign, potentially giving attackers a foothold in supply chain scenarios where picklescan is relied upon as a gatekeeper.

• CVE-2025-71349HIGH 8.1

  CVE-2025-71349 is a vulnerability in picklescan, a security tool designed to detect dangerous code embedded in Python pickle files. The flaw allows attackers to hide malicious code using Python's built-in trace.Trace.run function, which picklescan versions before 0.0.29 fail to recognize. When someone opens a specially crafted malicious pickle file with Python's pickle.load function, the hidden code runs automatically, giving the attacker control over the affected system. The vulnerability requires user interaction—someone must open the malicious pickle file—but once they do, the attacker gains full code execution capabilities.

• CVE-2025-71350HIGH 8.1

  Picklescan, a security tool designed to detect malicious Python pickle files, contains a bypass vulnerability that allows attackers to hide malicious code within pickle files. The vulnerability specifically involves the torch.utils.collect_env.run function, which picklescan fails to properly inspect when used in reduce methods. An attacker can craft a pickle file that executes arbitrary remote commands when a victim loads it, bypassing picklescan's detection. This is particularly dangerous because picklescan is often relied upon as a safety gate before deserializing untrusted pickle data.

• CVE-2025-71353HIGH 8.1

  Picklescan, a Python security tool designed to scan pickle files for malicious content, contains a detection bypass vulnerability in versions before 0.0.28. Attackers can craft specially designed pickle files that exploit a specific function in PyTorch's torch._dynamo.guards.GuardBuilder to hide malicious code. When these files are loaded by applications relying on picklescan for protection, the malicious payload executes despite the tool's screening, potentially giving attackers full command execution on affected systems.

• CVE-2025-71354HIGH 8.1

  picklescan, a security tool designed to detect malicious Python pickle files before they're executed, has a detection bypass vulnerability. Versions before 0.0.29 fail to recognize pickle files that abuse the idlelib.debugobj.ObjectTreeItem.SetText function within pickle reduce methods. An attacker can craft a malicious pickle file that passes picklescan's safety checks but executes arbitrary commands when loaded with pickle.load(), defeating the tool's intended protective purpose.

• CVE-2025-71356HIGH 8.1

  Picklescan, a tool designed to detect malicious code in Python pickle files, has a critical blind spot. Versions before 0.0.28 fail to recognize a specific attack pattern involving PyTorch's symbolic shape evaluation function. Attackers can weaponize this gap by embedding code that looks clean to picklescan but executes arbitrary commands when the pickle file is opened—a classic remote code execution scenario that puts any organization deserializing untrusted pickles at serious risk.

• CVE-2025-71357HIGH 8.1

  Picklescan, a Python library designed to detect malicious pickle files, has a detection bypass vulnerability in versions before 0.0.30. Attackers can craft pickle files that leverage Python's idlelib.pyshell.ModifiedInterpreter.runcommand function within reduce methods to execute arbitrary remote commands on systems that load the file. The vulnerability exists because picklescan fails to recognize this specific code execution path as dangerous, allowing malicious payloads to slip through security checks.

• CVE-2025-71358HIGH 8.1

  picklescan, a tool designed to scan pickle files for malicious content, contains a detection bypass flaw affecting versions before 0.0.29. The vulnerability allows attackers to craft malicious pickle files that evade picklescan's security checks by exploiting a specific function in Python's idlelib library. When victims use Python's standard pickle.load() to open these seemingly-safe files, arbitrary code executes on their systems. This is particularly dangerous because picklescan is often deployed as a safety gate—organizations rely on it to vet untrusted pickle data, making this bypass a fundamental breach of that trust.

• CVE-2025-71359HIGH 8.1

  picklescan is a Python library designed to scan pickle files for malicious code before they are deserialized. A flaw in versions before 0.0.29 allows attackers to bypass this safety mechanism by embedding malicious code using lib2to3.pgen2.grammar.Grammar.loads in the pickle's reduce method. When an application uses picklescan to check a file but then deserializes it anyway, the malicious payload executes during pickle.load(), giving attackers remote code execution.

• CVE-2025-71360HIGH 8.1

  Picklescan, a security scanning tool designed to detect malicious Python pickle files, has a detection bypass vulnerability affecting versions before 0.0.29. Attackers can craft pickle files that use the idlelib.calltip.get_entity function within reduce methods to evade picklescan's defenses. When a victim loads these crafted pickle files, arbitrary remote commands execute on their system. This is a critical supply-chain risk because picklescan is often deployed as a safety layer in applications that process untrusted pickle data.

• CVE-2025-71362HIGH 8.1

  picklescan is a security tool designed to scan Python pickle files for potentially dangerous code before they are deserialized. A flaw in versions prior to 0.0.33 allows attackers to bypass this protection by embedding malicious code that exploits a specific numpy function call pattern. When a pickle file containing this exploit is opened, the embedded code executes with the privileges of the user running the application. This affects anyone relying on picklescan to safely handle pickle files from untrusted sources.

• CVE-2025-71363HIGH 8.1

  picklescan is a Python library designed to detect malicious code in pickle files before they're deserialized. A flaw in picklescan versions before 0.0.30 allows attackers to craft pickle files that evade this detection by using cProfile.run function calls. When a user deserializes one of these malicious files, arbitrary code executes on their system. This is a critical failure in a security-focused tool—the very library meant to prevent pickle deserialization attacks can be bypassed.

• CVE-2025-71364HIGH 8.1

  CVE-2025-71364 is a high-severity flaw in picklescan, a security tool designed to detect malicious pickle files before they're loaded in Python applications. Versions before 0.0.30 have a blind spot: they fail to recognize a specific built-in function from asyncio that attackers can embed in crafted pickle files. When an application uses vulnerable picklescan to validate what it believes is a safe pickle file, the malicious payload bypasses detection and executes arbitrary code on the system. The attack requires user interaction—someone or some process must load the pickle file—but once that happens, an attacker gains full code execution.

• CVE-2025-71365HIGH 8.1

  picklescan is a Python security tool designed to detect malicious pickle files—a serialization format that can execute arbitrary code when deserialized. This vulnerability allows attackers to craft pickle files that slip past picklescan's detection by using a specific code path involving numpy's f2py.crackfortran.myeval function. When a user or application loads one of these malicious files thinking it's safe, the embedded code runs with the privileges of the process, potentially compromising the system.

• CVE-2025-71366HIGH 8.1

  picklescan is a Python library designed to scan pickle files for malicious code before they're loaded. Version 0.0.27 and earlier have a critical blind spot: they fail to detect when attackers embed calls to torch.utils.bottleneck.__main__.run_cprofile inside pickle files. An attacker can craft a malicious pickle file that passes picklescan's safety checks, then execute arbitrary code when a victim loads the file. The vulnerability requires user interaction (a victim must load the file), but once they do, the attacker gains full code execution with the victim's privileges.

• CVE-2025-71367HIGH 8.1

  picklescan, a security tool designed to scan Python pickle files for malicious code, has a bypass vulnerability in versions before 0.0.34. The tool fails to recognize a specific Python operator function (_operator.attrgetter) when it appears in crafted pickle payloads. An attacker can exploit this gap by embedding this function in a pickle file's reduce method—the mechanism pickle uses to reconstruct Python objects. When a developer or application uses pickle.load() to deserialize such a file, the malicious code executes because picklescan never flagged it as dangerous. This is particularly concerning because picklescan is often used as a front-line defense against pickle deserialization attacks.

• CVE-2025-71368HIGH 8.1

  picklescan is a Python security tool designed to scan pickle files for malicious code before they are deserialized. Version 0.0.29 and earlier contain a detection gap: they fail to recognize the doctest.debug_script function as a dangerous payload. An attacker can craft a malicious pickle file that embeds a call to doctest.debug_script, which executes arbitrary commands when the pickle is loaded by a victim. Because picklescan doesn't flag this function, users relying on it for protection may unknowingly deserialize and execute hostile code.

• CVE-2025-71369HIGH 8.1

  picklescan is a security tool designed to inspect Python pickle files and detect malicious payloads before they are deserialized. A flaw in versions before 0.0.28 allows attackers to craft pickle files that evade picklescan's detection by leveraging a specific PyTorch utility (torch.utils.data.datapipes.utils.decoder.basichandlers) within reduce methods. When a user or system trusts picklescan's clearance and deserializes such a file, the embedded malicious code executes with full privileges, potentially compromising the affected system.

• CVE-2025-71370HIGH 8.1

  picklescan, a library designed to detect malicious content in Python pickle files before they're deserialized, has a detection bypass vulnerability. Attackers can craft pickle files that embed a specific PyTorch function (torch.jit.unsupported_tensor_ops.execWrapper) in a way that picklescan fails to recognize as dangerous. When these files are loaded with pickle.load(), arbitrary code executes. The vulnerability affects picklescan versions before 0.0.28 and represents a critical failure in a security tool meant to prevent exactly this type of attack.

• CVE-2025-71371HIGH 8.1

  picklescan is a Python library designed to scan pickle files for malicious code before they're deserialized. A vulnerability in versions before 0.0.29 allows attackers to craft specially-crafted pickle payloads that evade picklescan's detection by using code.InteractiveInterpreter.runcode in reduce methods. When a user loads such a malicious pickle file, arbitrary code executes despite the file passing picklescan validation. This creates a false sense of security for teams relying on picklescan to vet untrusted pickle data.

• CVE-2025-71372HIGH 8.1

  Picklescan is a security tool designed to detect malicious code hidden in Python pickle files before they're executed. A vulnerability in versions before 0.0.33 allows attackers to bypass this protection by using a specific Python gadget chain (numpy.f2py.crackfortran.getlincoef) that Picklescan fails to recognize. An attacker can create a malicious pickle file that looks safe to Picklescan but executes arbitrary code when loaded, potentially compromising systems that rely on Picklescan to validate untrusted pickle data—particularly in machine learning supply chains where serialized models are shared.

• CVE-2025-71374HIGH 8.1

  picklescan is a security tool designed to scan Python pickle files for dangerous code before they are deserialized. Prior to version 0.0.29, picklescan had a detection gap: it failed to identify when the built-in Python profile.Profile.run function was used within pickle reduce methods. An attacker can exploit this gap by crafting a malicious pickle file that uses this undetected function to execute arbitrary code when the file is deserialized, even after passing through picklescan's security checks.

• CVE-2025-71375HIGH 8.1

  CVE-2025-71375 is a detection bypass vulnerability in picklescan, a security tool designed to scan Python pickle files for malicious code. Versions before 0.0.34 fail to recognize the _operator.methodcaller function, which attackers can exploit to craft pickle payloads that pass safety checks but execute arbitrary code when unpickled. This turns a defensive tool into a false sense of security, making it particularly dangerous for organizations relying on picklescan to validate untrusted pickle data.

• CVE-2025-71376HIGH 8.1

  picklescan, a Python library designed to detect malicious pickle files before they're loaded, has a critical detection bypass in versions before 0.0.29. Attackers can craft pickle files that hide arbitrary code execution payloads using a specific Python class (idlelib.autocomplete.AutoComplete.fetch_completions) within pickle serialization reduce methods. When a victim loads such a file with picklescan 0.0.28 or earlier, the scanner fails to flag it as dangerous, allowing the embedded malicious code to execute. This is particularly dangerous because pickle files are often used for data persistence, model storage in machine learning workflows, and configuration management—areas where developers might trust scanning tools to catch threats.

• CVE-2025-71378HIGH 8.1

  picklescan is a security tool designed to detect malicious code hidden in Python pickle files before they're loaded. A vulnerability in picklescan versions before 0.0.30 allows attackers to hide malicious code using the cProfile.runctx function in ways the tool fails to recognize. When a user thinks they're safely loading a scanned pickle file, the malicious code executes anyway, potentially giving attackers full control of the system. The vulnerability requires user interaction—someone must actually load the pickle file—but once they do, the attacker can run arbitrary commands.

• CVE-2026-27333HIGH 8.1

  Paid Videochat Turnkey Site versions 7.3.23 and earlier contain a critical weakness that allows attackers to execute arbitrary code without needing login credentials. The vulnerability exists in how the application handles incoming data serialization—specifically, it accepts and processes untrusted data without proper validation. An attacker on the network can craft a malicious request to trigger code execution, potentially compromising the entire system.

• CVE-2026-39253HIGH 8.1

  Pivotal CRM version 6.6.04.08 contains a critical vulnerability that allows attackers on the network to run malicious code on affected systems without needing valid credentials. The flaw exists in two core components responsible for data handling and service conversion, making it a direct path to system compromise. An attacker would need specific technical conditions to exploit this, but once successful, they gain complete control over the affected system.

• CVE-2026-39539HIGH 8.1

  Unauthenticated attackers can inject malicious PHP objects into Alloggio Hotel Booking plugin versions 2.1.2 and earlier, potentially gaining control of affected WordPress sites without requiring login credentials. This is a deserialization vulnerability—a common but severe weakness where untrusted data is converted back into executable code. Because no authentication is required and the attack can be carried out remotely, this poses an immediate risk to any exposed installation.

• CVE-2026-39550HIGH 8.1

  Aperitif, a WordPress theme by Elated-Themes, contains a deserialization flaw that allows attackers to inject malicious objects into the application. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code or compromise the integrity and confidentiality of affected websites. The vulnerability exists in versions 1.6 and earlier.

• CVE-2026-39551HIGH 8.1

  A critical flaw in Elated-Themes' Töbel plugin allows attackers to inject malicious objects through unsafe deserialization. An unauthenticated remote attacker can exploit this vulnerability to achieve arbitrary code execution, data theft, or system compromise. The attack requires some specific conditions to be met, but once exploited, grants full control over affected systems.

• CVE-2026-39555HIGH 8.1

  A critical flaw has been discovered in Elated-Themes' Askka plugin (versions up to and including 1.3.1) that allows attackers to inject malicious objects through deserialization of untrusted data. When the plugin processes serialized data from an untrusted source without proper validation, an attacker can craft a specially designed payload that, when deserialized by the vulnerable code, instantiates arbitrary PHP objects. This object injection can lead to remote code execution, data theft, or system compromise depending on available gadget chains within the application environment.

• CVE-2026-40859HIGH 8.1

  Apache Camel's vertx-http component contains a critical deserialization flaw that can lead to remote code execution. When the component is configured to transfer exceptions from backend HTTP responses (an opt-in setting), it deserializes Java objects from responses without any safety checks. An attacker controlling or intercepting the backend service can send a malicious serialized object that, if suitable gadget classes exist in the application's dependencies, executes arbitrary code on the Camel host. This vulnerability requires non-default configuration to trigger and relies on either compromising the backend service or intercepting unencrypted HTTP traffic.

• CVE-2026-41699HIGH 8.1

  Spring for GraphQL applications that use pagination features are vulnerable to a deserialization attack that can allow remote code execution. An attacker sends a specially crafted GraphQL query to a paginated endpoint; if the application's runtime environment contains certain gadget classes, the attack can execute arbitrary code on the server. The vulnerability affects Spring for GraphQL versions 1.3.0–1.3.8, 1.4.0–1.4.5, and 2.0.0–2.0.3.

• CVE-2026-41731HIGH 8.1

  Spring for Apache Kafka contains a flaw in how it validates trusted message header types. When a developer trusts a package for deserialization, the framework actually trusts that entire package and all of its subpackages. An attacker who can produce Kafka messages can exploit this overly broad trust to craft malicious header values that force the consumer to deserialize and instantiate arbitrary JDK classes. Combined with Jackson's default deserialization behavior, this can lead to remote code execution on systems processing the poisoned messages.

• CVE-2026-41732HIGH 8.1

  A flaw in Spring for Apache Pulsar's type-header validation allows an attacker to deserialize untrusted Java objects when the library is configured with a trusted-packages allowlist. The vulnerability has two related problems: first, trusting a package name implicitly trusts all of its subpackages due to a prefix-matching check, and second, an empty trusted-packages configuration defaults to trusting all packages instead of safely rejecting unknown types. An attacker on the network can exploit this by sending specially crafted messages to deserialize malicious objects, potentially leading to remote code execution.

• CVE-2026-41855HIGH 8.1

  Spring Framework's JMS message converters contain a deserialization flaw that allows attackers to instantiate arbitrary classes when processing untrusted messages from a JMS broker. An attacker with access to a JMS broker—or one who can inject malicious messages into it—can exploit gadget classes present on the application's classpath to execute unauthorized actions, including potential remote code execution. The vulnerability affects multiple recent versions of Spring Framework across several release branches.

• CVE-2026-42211HIGH 8.1

  React Router versions 7.0.0 through 7.14.1 contain a high-severity vulnerability that could enable remote code execution when using Framework Mode. The attack is two-stage: it requires an application to already contain a prototype pollution flaw, which an attacker can then exploit to trigger unauthorized code execution on the server. Applications using the library's Declarative Mode or Data Mode routing are unaffected. The vulnerability was patched in version 7.14.2.

• CVE-2026-42527HIGH 8.1

  Apache Camel contains a deserialization vulnerability that allows attackers to trigger DNS queries during message processing. When serialized Java objects are sent to affected Camel components—particularly JMS consumers—the framework's default security filter allows certain classes like java.net.URL through. An attacker can craft a HashMap with malicious URL keys that, when deserialized, causes the JVM to issue DNS queries to attacker-controlled servers. This creates an out-of-band information disclosure channel without requiring code execution. The risk is highest in JMS deployments where message deserialization happens by default.

• CVE-2026-43865HIGH 8.1

  Apache Camel's Hazelcast integration component has a critical flaw in how it handles data coming from cluster nodes. When Camel automatically creates and manages Hazelcast instances without custom configuration, it doesn't protect against malicious serialized Java objects. An attacker positioned on or able to reach the Hazelcast cluster can send a specially crafted object that gets automatically deserialized on every Camel node, executing arbitrary code. This happens silently in the background for any route using Hazelcast consumers or certain Camel repositories—no special endpoint setup is required for the vulnerability to exist.

• CVE-2026-49121HIGH 8.1

  AI Tensor Engine for ROCm (AITER) versions up to 0.1.14 contain a critical flaw that allows attackers to run arbitrary code on inference worker machines without authentication. An attacker who can reach certain network endpoints or forge specific credentials can send a specially crafted message that executes code with the privileges of the inference worker process across multiple nodes simultaneously. This vulnerability requires network access to specific cluster communication channels but bypasses all authentication and validation mechanisms.

• CVE-2026-49286HIGH 8.1

  PhpWeasyPrint, a PHP library for converting URLs and HTML pages into PDF files, contains a critical flaw that allows attackers to execute arbitrary code on servers running vulnerable versions. The library was supposed to block a dangerous file access method called `phar://`, but the protection was case-sensitive, meaning attackers could bypass it by using variations like `PHAR://` or `Phar://`. When an attacker tricks the application into processing a specially crafted PHAR archive, it triggers automatic code execution during deserialization on PHP 7 versions. This is a repeat of an earlier vulnerability that should have been fixed; the library was not comprehensive in its original patch. Upgrading to version 2.6.0 or later closes this hole.

• CVE-2026-50632HIGH 8.1

  Apache CXF contains a gap in a previously patched vulnerability that allows remote code execution when untrusted users can configure Java Message Service (JMS) endpoints. This is a second-order fix to CVE-2026-44417, indicating the original patch was incomplete. An attacker with JMS configuration privileges could execute arbitrary code on the system, making this a serious risk for organizations relying on Apache CXF to handle messaging.

• CVE-2026-50633HIGH 8.1

  Apache CXF, a widely-used web services framework, contains a JNDI (Java Naming and Directory Interface) injection flaw in its JCA integration module. An attacker who can modify the JCA deployment descriptor file (ra.xml) or influence runtime activation parameters could inject malicious code that executes with the privileges of the application server. This is a high-risk vulnerability because JNDI injection can lead to full code execution and system compromise.

• CVE-2026-54512HIGH 8.1

  jackson-databind, a widely-used Java library for converting between JSON and Java objects, contains a critical bypass of its built-in polymorphic type validation. When an application deserializes JSON with polymorphic types enabled, attackers can craft a type identifier that includes generic parameters (e.g., ArrayList<EvilClass>) to slip denied classes past the safety check. The validator only checks the outer container type (ArrayList) but ignores what's inside the angle brackets, allowing instantiation and exploitation of restricted classes. This affects versions from 2.10.0 through 2.18.7, 2.21.3, and 3.1.3.

• CVE-2026-10538HIGH 8.0

  CVE-2026-10538 is a deserialization vulnerability in Control-M messaging that allows authenticated attackers to trigger unintended server behavior by sending specially crafted serialized data. The flaw exists in out-of-support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier, where the messaging consumer fails to properly restrict which object types can be deserialized. An attacker with valid credentials can exploit this to compromise confidentiality, integrity, and availability across connected systems.

• CVE-2026-12240HIGH 8.0

  The Export User Data plugin for WordPress has a critical flaw that allows authenticated users with basic subscriber privileges to delete any file on the website's server. The vulnerability stems from improper validation when the plugin processes serialized data objects. An attacker can embed a malicious payload in their user profile's display name, and when a site administrator exports user data, the plugin deserializes and processes this payload unsafely, leading to file deletion. By strategically deleting essential files like wp-config.php, an attacker can gain complete control of the website or render it non-functional. This requires an admin to initiate the export, but since site administrators regularly perform data exports for legitimate reasons, the risk window is substantial.

• CVE-2026-10043HIGH 7.8

  MosaicML Composer contains a remote code execution vulnerability triggered when users open malicious checkpoint files. An attacker can craft a specially designed checkpoint file that, when deserialized by the application, executes arbitrary code with the privileges of the current user. Exploitation requires user interaction—a victim must be tricked into opening or visiting a malicious file or page. This is a deserialization flaw: the application fails to validate checkpoint data before processing it, allowing attackers to inject executable instructions into the saved model or training state.

• CVE-2026-12191HIGH 7.8

  A flaw in Comma AI's Openpilot version 0.11 allows a local attacker with basic user privileges to execute arbitrary code through unsafe deserialization of pickle files. The vulnerability exists in the model data loading component and requires an attacker to already have access to the system where Openpilot is running. While the attack surface is limited to local access, the impact is severe—an attacker can read, modify, or delete sensitive data, and compromise the integrity of the autonomous driving system.

• CVE-2026-24221HIGH 7.8

  NVIDIA's NVTabular library contains a deserialization vulnerability that could allow an authenticated attacker to execute arbitrary code, modify data, or steal sensitive information. The vulnerability is rated HIGH severity and requires local system access and valid user credentials to exploit. While not currently listed as actively exploited, this flaw merits prompt attention given the potential for code execution on systems processing sensitive machine learning datasets.

• CVE-2026-24228HIGH 7.8

  NVIDIA NeMo Framework for Linux has a vulnerability that allows an attacker with local access to execute arbitrary code by providing specially crafted data that the application deserializes without validation. This could give an attacker elevated privileges, the ability to modify data, or access to sensitive information. The vulnerability requires the attacker to already have local user-level access to the system.

• CVE-2026-24237HIGH 7.8

  NVIDIA NVTabular is vulnerable to unsafe deserialization of untrusted data. An attacker with local access and basic user privileges could exploit this flaw to execute arbitrary code, modify data, or steal sensitive information from systems running the affected software.

• CVE-2026-24240HIGH 7.8

  NVIDIA Megatron Bridge for Linux has a security flaw that allows attackers to execute arbitrary code on affected systems by tricking them into processing malicious data. An attacker without special permissions can exploit this vulnerability if a user interacts with a specially crafted file or input, potentially taking full control of the system, stealing sensitive data, or modifying files. The vulnerability affects the deserialization process—how the application reconstructs data from storage—and is rated as HIGH severity.

• CVE-2026-24243HIGH 7.8

  NVIDIA's Megatron Bridge for Linux has a flaw that allows attackers to execute malicious code on affected systems by tricking them into processing untrusted data. The vulnerability requires local access and user interaction, but successful exploitation could give an attacker full control over the system, access to sensitive information, and the ability to modify or delete data. This is a significant risk for organizations running NVIDIA's deep learning infrastructure components.

• CVE-2026-24244HIGH 7.8

  NVIDIA Megatron Bridge for Linux is vulnerable to unsafe deserialization, where an attacker can trick the software into processing malicious data. If successful, an attacker could run arbitrary code on the affected system, steal sensitive information, modify data, or gain elevated privileges. The vulnerability requires local access and user interaction (such as opening a malicious file), but poses significant risk to systems where Megatron Bridge processes untrusted input.

• CVE-2026-24245HIGH 7.8

  NVIDIA's Megatron Bridge for Linux contains a deserialization vulnerability that could allow an attacker to execute arbitrary code on an affected system. The vulnerability requires local access and user interaction—an attacker cannot exploit it remotely. If successfully exploited, the impact is severe: an attacker could run commands with the privileges of the affected user, tamper with data, steal sensitive information, or escalate privileges further. This is a local attack surface, meaning the threat actor must already have a presence on the target machine or trick a user into opening a malicious file.

• CVE-2026-24247HIGH 7.8

  NVIDIA's Megatron Bridge for Linux has a serious flaw that allows attackers to trick the software into processing malicious data. When an attacker sends specially crafted input, the application deserializes it without proper validation, potentially giving the attacker the ability to run code on the affected system, steal sensitive information, modify data, or gain elevated privileges. The vulnerability requires user interaction (such as opening a file or clicking a link) but no authentication.

• CVE-2026-24250HIGH 7.8

  NVIDIA Megatron Bridge for Linux has a vulnerability that fails to properly validate user inputs, potentially allowing an attacker with local access to execute code, gain elevated privileges, tamper with data, or steal sensitive information. The vulnerability requires an authenticated user on the system to exploit, but once triggered, the impact is severe.

• CVE-2026-24251HIGH 7.8

  NVIDIA's Megatron Bridge for Linux has a vulnerability that allows an attacker with local access to execute arbitrary code and gain elevated privileges on affected systems. The flaw stems from improper handling of dynamic code resources, which could let an authenticated user manipulate how the system manages executable code in memory. This is a serious issue for any organization running machine learning workloads that rely on Megatron optimization frameworks.

• CVE-2026-25551HIGH 7.8

  Seagull Software BarTender versions 2021 R1 through 12.0.1 contain a flaw that allows local users with standard privileges to gain system-level access. The vulnerability stems from how BarTender's system service handles incoming network requests—it trusts serialized data without proper validation, allowing an attacker to craft malicious requests that execute code with the highest Windows privileges. Because the vulnerable service only listens on the local machine, an attacker must already have a local user account to exploit it, but once inside, they can escalate to full system control.

• CVE-2026-38950HIGH 7.8

  ESA AnomalyMatch versions before 1.3.1 contain a critical flaw that allows attackers with local system access to run malicious code by uploading specially crafted model checkpoint files. The vulnerability stems from the application's use of unsafe deserialization when loading PyTorch model files, which can execute arbitrary Python code during the loading process. An attacker who can place a malicious model file in the session directories—or trick a user into loading one—gains the ability to execute commands with the privileges of the AnomalyMatch process.

• CVE-2026-46607HIGH 7.8

  Glances, a popular open-source system monitoring tool, has a critical flaw in how it handles version-check data. When Glances starts up, it reads a cached version file from your user's home directory using a method that blindly trusts whatever data is in that file. An attacker who gains write access to that cache location—whether through a compromised container, shared system, or other local privilege—can sneak in malicious data that executes arbitrary commands as the user running Glances. This only happens if version checking is enabled, which is the default. The issue affects all versions before 4.5.5.

• CVE-2026-13759HIGH 7.5

  IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 contain a deserialization vulnerability that allows attackers to execute arbitrary code on affected systems. The vulnerability exists because three internal classes fail to implement Java's standard class-filtering protections when deserializing untrusted data. When the Apache Coherence library is present on the classpath, attackers can exploit well-known gadget chains to achieve remote code execution. Two attack paths are possible: an authenticated attacker with the ability to inject malicious session attributes, or a network-adjacent attacker positioned on the grid replication communications channel. Both scenarios bypass normal deserialization safety mechanisms.

• CVE-2026-14265HIGH 7.5

  AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 contain a dangerous deserialization flaw in the RemoteQueryCachePlugin component. If an attacker gains write access to your Redis or Valkey cache layer, they can inject a malicious serialized Java object that executes arbitrary code on any application server reading from that cache. The vulnerability exists because the plugin deserializes cache entries without validating the object types first, making it vulnerable to Java gadget chain attacks.

• CVE-2026-48502HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a critical memory management vulnerability in the timestamp parsing logic. When processing specially crafted MessagePack messages, the library allocates stack memory based on attacker-supplied values without first validating those values are legitimate. This can trigger a stack overflow that crashes the entire application with no opportunity for error handling. An attacker can exploit this remotely with a tiny payload to take down services using vulnerable versions of the library.

• CVE-2026-48517HIGH 7.5

  MessagePack for C# contains a type-filtering bypass vulnerability in its typeless deserialization mechanism. The library implements a safety check to block dangerous types from being deserialized, but this check only examines the outermost type. An attacker can circumvent this protection by wrapping a blocked type inside an array or generic type wrapper, allowing the forbidden type to slip through validation and be instantiated anyway. This creates a deserialization attack surface that the vendor intended to close.

• CVE-2026-54499HIGH 7.5

  Stanza, Stanford's popular NLP library for Python, contains a code execution vulnerability in versions before 1.12.2. When loading pre-trained language models (such as tokenization or named entity recognition models), the library attempts a safe loading mode first but falls back to an unsafe mode when it encounters certain errors. An attacker can craft a malicious model file (.pt format) that exploits this fallback behavior to run arbitrary code on a user's machine during the normal process of loading a language model. The vulnerability requires user interaction—someone must attempt to load the malicious model—but no special privileges or network access are required beyond hosting or distributing the bad model file.

• CVE-2026-37579HIGH 7.3

  SMSGate sms-core versions 2.1.13.6 and earlier contain a remote code execution vulnerability in the CMPP7 message handling component. An unauthenticated attacker on the network can exploit this flaw to execute arbitrary code on affected systems without any user interaction, potentially gaining full control of the SMS gateway infrastructure.

• CVE-2026-40993HIGH 7.3

  Spring Security versions 7.0.0 through 7.0.5 contain a deserialization vulnerability in how they manage SAML metadata. An attacker who has write access to specific database tables can insert malicious serialized code into credential storage columns. When the application deserializes this data, it executes the attacker's payload. This requires existing database write privileges, but the impact can be severe—potentially allowing unauthorized access or system manipulation.

• CVE-2026-43825HIGH 7.3

  Apache OpenNLP's SvmDoccatModel contains a dangerous deserialization flaw that can allow attackers to execute arbitrary code. The vulnerability exists in how the library reads serialized model files—it deserializes untrusted data without proper validation, meaning malicious input can trigger code execution if certain common Java libraries are present on the system. This affects OpenNLP 3.x versions prior to 3.0.0-M4. The risk is highest for applications that load SvmDoccatModel instances from external or user-supplied sources.

• CVE-2026-43866HIGH 7.3

  Apache Camel and its JMS-related components contain a critical deserialization bypass vulnerability that allows an attacker to inject malicious Exchange state into JMS applications. The issue stems from an incomplete fix to a prior vulnerability (CVE-2026-40860): while that patch added a class allowlist to prevent arbitrary object deserialization, it inadvertently allowed a Camel internal class (DefaultExchangeHolder) to slip through. An attacker who can publish a crafted ObjectMessage to a JMS queue or topic consumed by a vulnerable Camel application can exploit this to manipulate routing logic, inject headers, modify properties, and alter error handling—all without needing a complex deserialization gadget chain. The attack leverages only standard Java classes that all systems trust.

• CVE-2026-45360HIGH 7.3

  Apache Airflow's scheduler contains a deserialization vulnerability in how it handles deadline references created by DAG authors. When a DAG author creates a custom deadline reference, the scheduler deserializes it without validating what code it might execute. An attacker who can author a DAG—or influence its contents—can embed malicious class paths that the scheduler will import and instantiate, gaining the ability to execute arbitrary code within the scheduler's security context and access its database connection.