tag

Cwe-502

Sitecore XP Report.ashx Insecure Deserialization RCE (CVE-2021-42237)

CVE-2021-42237 (Sitecore advisory SC2021-003-499266)· Sitecore Experience Platform (XP) unpatched

SAP NetWeaver Visual Composer Unrestricted File Upload RCE (CVE-2025-31324)

CVE-2025-31324· SAP NetWeaver Application Server (AS) Java — Visual Composer component (VCFRAMEWORK), specifically the Metadata Uploader servlet patched

Roundcube Webmail Post-Auth RCE via PHP Object Deserialization (CVE-2025-49113)

CVE-2025-49113· Roundcube Webmail unpatched

Laravel Livewire Remote Code Execution via Known APP_KEY (CVE-2025-54068)

CVE-2025-54068· Laravel Livewire (versions prior to v3.6.4) unpatched

GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)

CVE-2025-22777· GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs) patched

Apache Parquet-Avro Schema Deserialization RCE/SSRF — Incomplete-Fix Bypass (CVE-2025-30065)

CVE-2025-30065· Apache Parquet Java (parquet-avro module) patched

Apache Camel `camel-consul` ConsulRegistry Deserialization RCE (CVE-2026-27172)

CVE-2026-27172· Apache Camel camel-consul component (org.apache.camel.component.consul.ConsulRegistry) unpatched

WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806

CVE-2026-54806· WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress patched

SP LMS PHP Object Injection → Unauthenticated RCE (CVE-2026-48909)

CVE-2026-48909 (GHSA-gf8c-xmwj-whrh)· JoomShaper SP LMS (com_splms) Joomla Learning Management System extension patched

MLflow / MLServer Insecure Pickle Deserialization RCE — CVE-2026-0596

CVE-2026-0596 (GHSA-rvhj-8chj-8v3c)· MLflow model serving stack (mlflow==2.11.1, mlserver==1.3.5, mlserver-mlflow==1.3.5) unpatched

High (advisory also describes user impersonation and Script Console RCE via the same primitive; this PoC demonstrates file-read impact only)

Jenkins ClassFilter Deserialization Bypass → Arbitrary File Read — CVE-2026-53435

CVE-2026-53435 (Jenkins SECURITY-3707)· Jenkins (core), View configuration (config.xml) deserialization path patched

Integration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)

CVE-2026-9691· "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin unpatched

Everest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)

CVE-2026-3296· Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder) patched

docling-core Unsafe YAML Deserialization Leading to Code Execution — CVE-2026-24009

CVE-2026-24009· docling-core (Python library) unpatched

Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779)

CVE-2026-42779· Apache MINA (mina-core) unpatched