CVE-2021-21350
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a
CVSS
5.3
Medium
EPSS
15.2%
p97
KEV
—
Exploit Today
29
0-100
Published: Mar 23, 2021 · Last modified: Oct 7, 2026 · CWE-434 · CWE-502
15.2%EPSS · 30 days15.2%
2026-09-262026-10-25
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- x-stream.github.iohttp://x-stream.github.io/changes.html#1.4.16
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq
- lists.apache.orghttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210430-0002/
- www.debian.orghttps://www.debian.org/security/2021/dsa-5004
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
- x-stream.github.iohttps://x-stream.github.io/CVE-2021-21350.html
- x-stream.github.iohttps://x-stream.github.io/security.html#workaround
- x-stream.github.iohttp://x-stream.github.io/changes.html#1.4.16
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-43gc-mjxg-gvrq
- lists.apache.orghttps://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r9ac71b047767205aa22e3a08cb33f3e0586de6b2fac48b425c6e16b0%40%3Cdev.jmeter.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00002.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1160446.3 MED10.5%
——3A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.16hCVE-2026-1147047.2 HIG35.2%
——11Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.1dCVE-2026-940759.8 CRI38.8%
——12Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.1dCVE-2026-1141969.8 CRI38.8%
——12Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.1dCVE-2026-1158069.8 CRI45.7%
——14The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.2dCVE-2026-578458.8 HIG45.6%
——14Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed by Pandas._generate_tables via pandas.read_pickle() without validation, so when a victim calls datasets.load_dataset("pandas", data_files=...), the embedded __reduce__ payload executes code with the victim process's privileges.2d