Unsafe deserialization vulnerabilities
The application rebuilds objects from untrusted data, and a crafted payload makes it run code or misbehave while doing so.
Unsafe deserialization in numbers
sbomify tracks 3,875 unsafe deserialization vulnerabilities. Most are found in cms plugin (30%), library (28%) and server software (21%).
How to fix unsafe deserialization vulnerabilities
Upgrade, and only deserialise data from trusted sources or with an allow-list of types.
Most exploited unsafe deserialization vulnerabilities
- CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data
- CVE-2025-55182 Meta React Server Components Remote Code Execution
- CVE-2025-10035 Fortra GoAnywhere MFT Deserialization of Untrusted Data
- CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data
- CVE-2023-40044 Progress WS_FTP Server Deserialization of Untrusted Data
- CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data
- CVE-2025-24016 Wazuh Server Deserialization of Untrusted Data
- CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data
- CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data
- CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data
- CVE-2026-20963 Microsoft SharePoint Deserialization of Untrusted Data
Recently published
- CVE-2026-108771 Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
- CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
- CVE-2026-112081 hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
- CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
- CVE-2026-112304 docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.