Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 20 of 37
Mar 31, 2025Untrusted data deserialization vulnerability exists in a-blog cms.CVE-2025-31103 · Computers, phones & browsers · appleple inc. · reported by vultures@jpcert.or.jpHigh 7.5
Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.
- Product
- a-blog cms (Ver.3.1.x series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.a-blogcms.jpdeveloper.a-blogcms.jp
Mar 28, 2025PHP/MySQL CPU performance statistics: Deserialization of Untrusted DataCVE-2025-22526 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.
- Product
- PHP/MySQL CPU performance statistics
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update PHP/MySQL CPU performance statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Traveler: Deserialization of Untrusted DataCVE-2025-26873 · WordPress plugins & themes · reported by PatchstackCritical 9
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-30773 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
- Product
- TranslatePress
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet.CVE-2025-29310 · Other software · Opennetworking · reported by MITRECritical 9.8
An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information.
- Product
- Onos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.CVE-2025-29807 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dataverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1.CVE-2024-9070 · Other software · bentoml · reported by security@huntr.devCritical 9.8
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
- Product
- bentoml/bentoml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted daCVE-2024-8502 · Other software · modelscope · reported by security@huntr.devCritical 9.8
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
- Product
- modelscope/agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3CVE-2024-11039 · Other software · binary-husky · reported by security@huntr.devHigh 8.8
A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b.
- Product
- binary-husky/gpt_academic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrustedCVE-2024-10553 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).CVE-2024-47552 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable. Users are recommended to upgrade to version 2.2.0, which fixes the issue.
- Product
- Apache Seata (incubating)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 15, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-26921 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2025An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory.CVE-2024-10838 · Other software · Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
- Product
- Eclipse Cyclone DDS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.CVE-2025-27925 · Other software · Nintex · reported by MITREHigh 8.5
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
- Product
- Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.CVE-2025-25940 · Other software · Visicut · reported by MITRECritical 9.8
VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
- Product
- Visicut
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroyblume.github.io
Mar 7, 2025A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization ofCVE-2025-27816 · Other software · reported by MITRECritical 9.8
A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploited due to the insecure deserialization of potentially untrusted messages. The vulnerability is present in the Windows Plugin_Host service, which runs on all the servers where InfoScale is installed. The service is used only when applications are configured for Disaster Recovery (DR) using the DR wizard. Disabling the Plugin_Host service manually will eliminate the vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution.CVE-2024-12742 · Other software · NI · reported by security@ni.comHigh 8.4
A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects G Web Development Software 2022 Q3 and prior versions.
- Product
- G Web Development Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025ProfileGrid: Deserialization of Untrusted DataCVE-2025-26999 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.3.
- Product
- ProfileGrid
- Affected
- up to 5.9.4.3
- What to do
- Affects up to 5.9.4.3. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Events Calendar for GeoDirectory: Deserialization of Untrusted DataCVE-2025-26967 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
- Product
- Events Calendar for GeoDirectory
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update Events Calendar for GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WordPress Assistant: Deserialization of Untrusted DataCVE-2025-26885 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.
- Product
- WordPress Assistant
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WordPress Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1CVE-2024-47092 · Other software · Heinlein-support · reported by security@checkmk.comHigh 7.7
Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1
- Product
- Check MK Python API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.checkmk.comgithub.com
Feb 25, 2025Flexmls® IDX: Deserialization of Untrusted DataCVE-2025-26900 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.27
- What to do
- Affects up to 3.14.27. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025NHR Options Table Manager: Deserialization of Untrusted DataCVE-2025-27301 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue affects NHR Options Table Manager: from n/a through <= 1.1.2.
- Product
- NHR Options Table Manager
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update NHR Options Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025ADFO: Deserialization of Untrusted DataCVE-2025-27300 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1.
- Product
- ADFO
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update ADFO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2025-26763 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.94.0
- What to do
- Affects up to 3.94.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2025Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.CVE-2025-26794 · Other software · Exim · reported by MITREHigh 7.5
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
- Product
- Exim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comcode.exim.org
Feb 20, 2025Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.CVE-2025-27218 · Other software · reported by MITREMedium 5.3
Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization.CVE-2024-28777 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization. This vulnerability allows users to execute arbitrary code, escalate privileges, or cause denial of service attacks by exploiting the unrestricted deserialization of types in the application.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\maCVE-2024-56180 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.
- Product
- Apache EventMesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 14, 2025In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints.CVE-2024-52577 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.5
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
- Product
- Apache Ignite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 10, 2025Wazuh Server Deserialization of Untrusted Data VulnerabilityCVE-2025-24016 · Other software · Wazuh · reported by GitHubExploitedCritical 9.9
Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.
- Product
- Wazuh Server
- On CISA’s list since
- Jun 10, 2025 (federal fix deadline Jul 1, 2025)
- What to do
- Attackers are using this now. Install Wazuh’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comcisa.gov
Feb 7, 2025Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data.CVE-2021-27017 · Other software · PuppetPu · reported by security@puppet.comMedium 6.6
Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.
- Product
- Puppet Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Trimble Cityworks Deserialization VulnerabilityCVE-2025-0994 · Other software · Trimble · reported by ics-cert@hq.dhs.govExploitedHigh 8.6
Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server.
- Product
- Cityworks
- On CISA’s list since
- Feb 7, 2025 (federal fix deadline Feb 28, 2025)
- What to do
- Attackers are using this now. Install Trimble’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloglearn.assetlifecycle.trimble.comcisa.gov
Feb 3, 2025Taxi Booking Manager for WooCommerce: Deserialization of Untrusted DataCVE-2025-24661 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue.CVE-2024-0140 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.8
NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
- Product
- RAPIDS cuDF and cuML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Save as PDF: Deserialization of Untrusted DataCVE-2025-24671 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.
- Product
- Save as PDF
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
- Product
- FundPress
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SonicWall SMA1000 Appliances Deserialization VulnerabilityCVE-2025-23006 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
- Product
- SMA1000 Appliances
- On CISA’s list since
- Jan 24, 2025 (federal fix deadline Feb 14, 2025)
- What to do
- Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpsirt.global.sonicwall.comcisa.gov
Jan 22, 2025Muzaara Google Ads Report: Deserialization of Untrusted DataCVE-2025-23914 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.
- Product
- Muzaara Google Ads Report
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Muzaara Google Ads Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025WOOEXIM: Deserialization of Untrusted DataCVE-2025-23944 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
- Product
- WOOEXIM
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Quick Count: Deserialization of Untrusted DataCVE-2025-23932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.
- Product
- Quick Count
- Affected
- up to 3.00
- What to do
- Affects up to 3.00. Update Quick Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler.CVE-2023-37008 · Other software · Open5gs · reported by MITREMedium 5.3
Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This buffer overflow causes type confusion in decoded fields, leading to invalid parsing and freeing of memory. An attacker may use this to crash an MME or potentially execute code in certain circumstances.
- Product
- Open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization.CVE-2024-49744 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 19, 2025The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sysCVE-2025-0586 · Other software · aEnrich Technology · reported by twcert@cert.org.twHigh 7.2
The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.
- Product
- a+HRD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 17, 2025CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on worCVE-2024-12703 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.
- Product
- RemoteConnect and SCADAPack x70 Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.CVE-2024-57766 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.CVE-2024-57764 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.CVE-2024-57763 · Other software · Wangl1989 · reported by MITRECritical 9.1
MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.
- Product
- Mysiteforme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.