SAP NetWeaver Business Client does not perform sufficient validation when processing certain...
CVE-2026-76967
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during
#cwe-502
共收录 943 条相关情报。
← 返回所有主题SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on t...
CVE-2026-76967
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Custo...
CVE-2026-7861
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Manageme
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/bloc...
CVE-2026-86404
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInp
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for...
CVE-2026-10196
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and includin...
CVE-2026-10196
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Tele...
CVE-2026-19887
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue ha...
CVE-2026-52777
CVE-2026-52777 是 YesWiki（一个基于 PHP 开发的 wiki 系统）中存在的已认证 PHP 对象注入漏洞。在 4.6.6 版本之前，BazarImportAction 功能在数据处理过程中使用了不安全的 unseri
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after rec...
CVE-2026-61686
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `
SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
CVE-2026-61686
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `
Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentati...
CVE-2026-19795
Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY p
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
CVE-2026-84834
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
CVE-2026-84753
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
CVE-2026-84752
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged...
CVE-2026-84832
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow w
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that...
CVE-2026-84670
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deseriali
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from...
CVE-2026-84650
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowin
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins...
CVE-2026-84647
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the bu...
CVE-2026-84670
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when