Not really a surprise, to be honest. "Deserialisation" encapsulates most forms of injection attacks. OWASP top-10 was dominated by those for a very long time.

Not really a surprise, to be honest. "Deserialisation" encapsulates most forms of injection attacks. OWASP top-10 was dominated by those for a very long time. They have only recently been overtaken by authorization failures.