Insecure Deserialization
Object reconstruction from attacker-influenced data, including allow-list bypasses.
Published work on this topic
| 2026-10-13 | CVE-2026-87930 | CVE-2026-87930 Exploit: MaxSite Object Injection RCE | PoC | |
| 2026-09-11 | CVE-2026-84647 | CVE-2026-84647 Exploit: Jenkins Stapler Type Confusion | PoC | |
| 2026-09-08 | CVE-2026-16723 | CVE-2026-16723 Exploit: fastjson RCE | PoC | |
| 2026-09-07 | CVE-2025-55182 | CVE-2025-55182: React2Shell Pre-Auth RCE | PoC | |
| 2026-08-15 | CVE-2026-34486 | CVE-2026-34486: Tomcat Tribes RCE | PoC | |
| 2026-08-11 | CVE-2025-24813 | CVE-2025-24813: Apache Tomcat Partial PUT RCE | PoC |
Other topics
remote code execution43authentication bypass19wordpress17php16authorization bypass9java9path traversal9privilege escalation9sql injection8code injection7denial of service6heap overflow6information disclosure5qemu5apache tomcat4buffer overflow4gitlab4go4node.js4python4cross-site scripting4account takeover3gitea3