deserialization

• CVE-2026-53914 - JetBrains Kotlin unsafe deserialization 2026-06-29
• CVE-2026-45051 - OpenAM WebAuthn deserialization RCE 2026-06-24
• CVE-2026-12191 - openpilot pickle deserialization 2026-06-16
• CVE-2026-48109 - MessagePack LZ4 decompression denial of service 2026-06-14
• CVE-2025-55182 - React Server Components RCE 2026-06-11
• CVE-2026-45034 - PHPSpreadsheet PHAR wrapper patch bypass 2026-06-11
• CVE-2026-40993 - Spring Security JDBC SAML credential deserialization 2026-06-10
• CVE-2026-40993 - Spring Security SAML credential BLOB deserialization RCE 2026-06-10
• CVE-2026-42211 - React Router Framework Mode deserialization RCE 2026-06-06
• CVE-2026-42779 - Apache MINA resolveClass deserialization RCE 2026-05-02
• CVE-2025-60455 - Modular Max Serve unsafe deserialization 2026-04-26
• CVE-2026-24159 — NVIDIA NeMo deserialization RCE 2026-04-26
• CVE-2026-24164 — NVIDIA BioNeMo deserialization RCE 2026-04-26
• PHP object deserialization — `unserialize` on untrusted data 2026-04-26
• Ruby unsafe deserialization — `Marshal.load` / `YAML.load` 2026-04-26
• CVE-2017-18342 — PyYAML default `load` resolves arbitrary tags 2026-04-25
• Java ObjectInputStream and friends 2026-04-25
• Python pickle / dill on untrusted input 2026-04-25
• PyYAML `yaml.load` without a safe Loader 2026-04-25