CVE-2021-21343
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p
CVSS
5.3
Medium
EPSS
46.7%
p99
KEV
—
Exploit Today
30
0-100
Published: Mar 23, 2021 · Last modified: Oct 7, 2026 · CWE-73 · CWE-502
46.7%EPSS · 30 days46.7%
2026-09-302026-10-27
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- x-stream.github.iohttp://x-stream.github.io/changes.html#1.4.16
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf
- lists.apache.orghttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210430-0002/
- www.debian.orghttps://www.debian.org/security/2021/dsa-5004
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
- x-stream.github.iohttps://x-stream.github.io/CVE-2021-21343.html
- x-stream.github.iohttps://x-stream.github.io/security.html#workaround
- x-stream.github.iohttp://x-stream.github.io/changes.html#1.4.16
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-74cv-f58x-f9wf
- lists.apache.orghttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1186177.8 HIG—
———Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the load_dataset_cache_file function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30124.18hCVE-2026-1186137.8 HIG—
———Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the torch_load function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-29652.18hCVE-2026-1163907.2 HIG—
———Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.20hCVE-2026-1163898.8 HIG—
———Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.20hCVE-2026-1159689.8 CRI—
———Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.19hCVE-2026-1155907.2 HIG—
———Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.20h