connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)
HackerOne8x82026-09-01$3,000 bounty
Web
Critical
BUG BOUNTY WRITEUPS
Insecure deserialization writeups
Untrusted data turned back into objects, and the gadget chains that turn that into code execution.
37 reports and writeups from 2024 to 2026. 12 carry a severity from the disclosing platform, 7 of them rated High or Critical. Last updated 2026-10-30.
Latest Insecure deserialization reports
Search and filter all writeupsTwo click Account Takeover
HackerOneBasecamp2025-11-11
Web
High
insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)
HackerOneMars2025-05-12
Web
Critical
CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
HackerOneInternet Bug Bounty2025-04-27$4,323 bounty
Web
High
CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci
HackerOneMTN Group2024-11-16
Web
Critical
[Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization
HackerOneNintendo2024-09-30
Binary
Medium
Attacking PowerShell CLIXML Deserialization
Researcher blogMicrosoft2024-09-13
Web
Not rated
Getting code execution on Veeam through CVE-2023-27532
Researcher blogVeeam2024-09-10
Web, Source Code
Not rated
3 ways to get Remote Code Execution in Kafka UI
Researcher blogKafka UI2024-07-23
Web
Not rated
Dynamics 365 Business Central - A Journey With Ups and Downs
GitHubMicrosoft2024-07-10
Web
Not rated
Navgraph confusion allows any 3p app to send and read requests from the server at app.hey.com
HackerOneBasecamp2024-07-09
Web
Medium
Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough
Researcher blogPyTorch, AWS, Google2024-07-08
Web, Cloud, AI
Not rated
Why nested deserialization is harmful: Magento XXE (CVE-2024-34102)
Researcher blogMagento2024-06-26
Web, Source Code
Not rated
[HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf
HackerOneU.S. Dept Of Defense2024-06-18
Web
Critical
Molding Lies Into Reality || Exploiting CVE-2024-4358
Researcher blogProgress (Telerik)2024-06-03
Web, Source Code
Not rated
Account takeover via insecure intent handling
HackerOneBasecamp2024-05-30
Android
Medium
My LLM Bug Bounty Journey on Hugging Face Hub via Protect AI
MediumHugging Face, Protect AI2024-05-11$3,250 bounty
Web, AI
Not rated
Unsafe yaml load can lead to remote code execution
HackerOneLiberapay2024-05-04
Web
Low
R-bitrary Code Execution: Vulnerability In R’s Deserialization (CVE-2024-27322)
Researcher blogR2024-04-29
Web
Not rated
Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations
Researcher blogHugging Face2024-04-04$200 bounty
Web, Cloud, AI
Not rated
Apache Dubbo Consumer Risks: The Road Not Taken
Researcher blogApache Dubbo2024-04-01
Web, Source Code
Not rated
Java Deserialization Tricks
Researcher blog2024-03-19
Web, Source Code
Not rated
Discovering Deserialization Gadget Chains in Rubyland
Researcher blog2024-03-13
Web
Not rated
Bundler's RCE with response using Marshal
HackerOneRubyGems2024-03-12
Web
Not rated
Continuing the Citrix Saga: CVE-2023-5914 & CVE-2023-6184
Researcher blogCitrix Systems2024-02-20
Web, Source Code
Not rated
Nom for Security: A Proactive Security Review of Nomulus
Researcher blogGoogle (Nomulus)2024-02-20
Web
Not rated
Hello Lucee! Let us hack Apple again?
Researcher blogApple, Lucee2024-02-15$20,000 bounty
Web, Source Code
Not rated
PHP deserialization attacks and a new gadget chain in Laravel
Researcher blog2024-02-13
Web
Not rated
Java applet + serialization in 2024! What could go wrong?
Researcher blog2024-02-08
Web
Not rated
Relution Remote Code Execution via Java Deserialization Vulnerability
Researcher blogRelution2024-01-31
Web, Source Code
Not rated
Pickle deserialization vulnerability in XComs
HackerOneInternet Bug Bounty2024-01-29
Web
Low
Multiple vulnerabilities in Cisco Unified Communications Manager version 11.5.1
Researcher blogCisco2024-01-24
Web
Not rated
Gambio 4.9.2.0 - Insecure Deserialization
Researcher blogGambio2024-01-19
Web, Source Code
Not rated
Unauthenticated RCE in Adobe Coldfusion – CVE-2023-26360
Researcher blogAdobe (ColdFusion)2024-01-10
Web, Source Code
Not rated
CVE-2023–50220 — Inductive Automation Ignition XML Deserialization to RCE
MediumInductive Automation Ignition2024-01-10
Web, Source Code
Not rated
CVE-2023-46132
HackerOneLinux Foundation Decentralized Trust2024-01-08
Linux
High
Panic!! At the YAML
Researcher blogsnakeyaml2024-01-03
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.