Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2424 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-40553 1 Solarwinds 1 Web Help Desk 2026-02-03 9.8 Critical
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVE-2025-61505 1 E107 1 E107 2026-02-03 6.5 Medium
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase.
CVE-2025-30160 1 Redlib 1 Redlib 2026-02-03 7.5 High
Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.
CVE-2025-54723 1 Wordpress 1 Wordpress 2026-02-03 9.8 Critical
Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
CVE-2025-33210 1 Nvidia 1 Isaac Lab 2026-02-02 9 Critical
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution.
CVE-2026-24747 2 Linuxfoundation, Pytorch 2 Pytorch, Pytorch 2026-01-30 8.8 High
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.
CVE-2025-27925 1 Nintex 1 Automation 2026-01-29 8.5 High
Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.
CVE-2025-67619 2 Designthemes, Wordpress 2 Kids Heaven, Wordpress 2026-01-29 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
CVE-2025-67617 1 Wordpress 1 Wordpress 2026-01-29 9.8 Critical
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
CVE-2025-69099 1 Wordpress 1 Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.
CVE-2025-27522 1 Apache 1 Inlong 2026-01-28 6.5 Medium
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732
CVE-2024-37502 3 Wordpress, Wpweb, Wpwebelite 3 Wordpress, Woocommerce Social Login, Woocommerce Social Login 2026-01-28 5.4 Medium
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login.This issue affects WooCommerce Social Login: from n/a through 2.6.3.
CVE-2025-68047 2 Arraytics, Wordpress 2 Eventin, Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.1.
CVE-2025-69036 1 Wordpress 1 Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through <= 16.4.
CVE-2025-69035 1 Wordpress 1 Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a through <= 20.2.
CVE-2025-69002 2 Designthemes, Wordpress 2 Onelife, Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVE-2025-39485 1 Themegoods 1 Grand Tour 2026-01-28 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour | Travel Agency WordPress allows Object Injection. This issue affects Grand Tour | Travel Agency WordPress: from n/a through 5.5.1.
CVE-2025-39354 2 Themegoods, Wordpress 2 Grand Conference, Wordpress 2026-01-28 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference allows Object Injection.This issue affects Grand Conference: from n/a through 5.2.
CVE-2025-68899 2 Designthemes, Wordpress 2 Vivagh, Wordpress 2026-01-27 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
CVE-2025-68903 1 Wordpress 1 Wordpress 2026-01-27 8.8 High
Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0.