Deserialization

Articles tagged Deserialization

• 
  Vulnerability

  Ajax.NET Professional Insecure Deserialization (CVE-2021-23758)

  CVE-2021-23758 is a 2021 CVSS 8.1 deserialization RCE in Ajax.NET Professional, added to CISA KEV in August 2026.

  ajax-net-professionaldeserializationremote-code-execution +2

  2026-09-20
• 
  Vulnerability

  The Events Calendar Insecure Deserialization (CVE-2026-78006)

  CVE-2026-78006 is a CVSS 9.8 deserialization flaw enabling unauthenticated RCE in WordPress plugin The Events Calendar, reported exploited by VulnCheck KEV.

  the-events-calendarstellarwpwordpress +4

  2026-09-20
• 
  Vulnerability

  GiveWP Insecure Deserialization (CVE-2026-82222)

  CVE-2026-82222 is a CVSS 10.0 deserialization flaw in the GiveWP WordPress donation plugin through 4.16.7.1, reported as exploited by VulnCheck's KEV catalog.

  givewpwordpressdeserialization +3

  2026-09-17
• 
  Vulnerability

  Microsoft Entra ID Insecure Deserialization (CVE-2026-69836)

  CVE-2026-69836 is a CVSS 10.0 deserialization RCE in Microsoft Entra ID that Microsoft confirms was never exploited, despite its VulnCheck KEV listing.

  microsoftentra-iddeserialization +4

  2026-09-17
• 
  Vulnerability

  h2oai h2o-3 Insecure Deserialization (CVE-2026-8751)

  CVE-2026-8751 is a CVSS 7.3 high-severity insecure-deserialization flaw in h2o-3's model-import handler, publicly disclosed after the vendor did not respond to the report.

  h2o-3machine-learningdeserialization +1

  2026-09-12
• 
  Vulnerability

  Red Hat JBoss EAP Insecure Deserialization (CVE-2026-86404)

  CVE-2026-86404 is a CVSS 8.8 high-severity insecure-deserialization flaw in JBoss EAP embedded ActiveMQ Artemis, where empty allow/block lists mean every class is deserializable by default.

  red-hatjbossactivemq +2

  2026-08-31