In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to speci...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowin

历史摘要 · 未重新核验 · NVD

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types ...

CVE-2026-84647

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS

历史摘要 · 未重新核验 · NVD

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read per...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deseriali

历史摘要 · 未重新核验 · NVD

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user imp...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PH

历史摘要 · 未重新核验 · NVD

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.

CVE-2026-81772

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.

历史摘要 · 未重新核验 · NVD

Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

CVE-2026-81283

Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

历史摘要 · 未重新核验 · NVD

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing f...

CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized wh

历史摘要 · 未重新核验 · NVD

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP o...

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitra

历史摘要 · 未重新核验 · NVD

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitra

历史摘要 · 未重新核验 · OSV.dev

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially craft...

CVE-2026-72649

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code exec

历史摘要 · 未重新核验 · NVD

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

## Summary MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load

历史摘要 · 未重新核验 · GitHub Advisory

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft ma...

CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution throug

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61779

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61778

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61777

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61776

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61775

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61774

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61773

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61772

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD