diff --git a/administrator/components/com_finder/src/Model/SearchesModel.php b/administrator/components/com_finder/src/Model/SearchesModel.php
index 5cdff1385b1c2..35acd95344981 100644
--- a/administrator/components/com_finder/src/Model/SearchesModel.php
+++ b/administrator/components/com_finder/src/Model/SearchesModel.php
@@ -13,6 +13,7 @@
 use Joomla\CMS\Component\ComponentHelper;
 use Joomla\CMS\MVC\Factory\MVCFactoryInterface;
 use Joomla\CMS\MVC\Model\ListModel;
+use Joomla\Component\Finder\Administrator\Indexer\Query;
 use Joomla\Database\QueryInterface;
 
 // phpcs:disable PSR1.Files.SideEffects
@@ -141,9 +142,9 @@ public function getItems()
 
         foreach ($items as $item) {
             if (\is_resource($item->query)) {
-                $item->query = unserialize(stream_get_contents($item->query));
+                $item->query = unserialize(stream_get_contents($item->query), ['allowed_classes' => [Query::class]]);
             } else {
-                $item->query = unserialize($item->query);
+                $item->query = unserialize($item->query, ['allowed_classes' => [Query::class]]);
             }
         }
 
diff --git a/components/com_finder/src/Model/SearchModel.php b/components/com_finder/src/Model/SearchModel.php
index 13a399e402767..44cb71b15fc7f 100644
--- a/components/com_finder/src/Model/SearchModel.php
+++ b/components/com_finder/src/Model/SearchModel.php
@@ -17,6 +17,7 @@
 use Joomla\CMS\Plugin\PluginHelper;
 use Joomla\CMS\Uri\Uri;
 use Joomla\Component\Finder\Administrator\Indexer\Query;
+use Joomla\Component\Finder\Administrator\Indexer\Result;
 use Joomla\Database\QueryInterface;
 use Joomla\String\StringHelper;
 
@@ -116,9 +117,9 @@ public function getItems()
         foreach ($items as $row) {
             // Build the result object.
             if (\is_resource($row->object)) {
-                $result = unserialize(stream_get_contents($row->object));
+                $result = unserialize(stream_get_contents($row->object), ['allowed_classes' => [Result::class]]);
             } else {
-                $result = unserialize($row->object);
+                $result = unserialize($row->object, ['allowed_classes' => [Result::class]]);
             }
 
             $result->cleanURL = $result->route;
diff --git a/libraries/src/Cache/Controller/CallbackController.php b/libraries/src/Cache/Controller/CallbackController.php
index e8161c544f0fe..f30cdd1cd4d44 100644
--- a/libraries/src/Cache/Controller/CallbackController.php
+++ b/libraries/src/Cache/Controller/CallbackController.php
@@ -74,7 +74,16 @@ public function get($callback, $args = [], $id = false, $wrkarounds = false, $wo
                 $this->cache->unlock($id);
             }
 
-            $data = unserialize(trim($data));
+            $trimmed = trim($data);
+
+            // Try secure deserialization first
+            $data = @unserialize($trimmed, ['allowed_classes' => false]);
+
+            // Fallback for backward compatibility: if secure unserialize failed and the serialized data is not boolean false
+            if ($data === false && $trimmed !== 'b:0;') {
+                // Legacy fallback to preserve existing cache entries that store objects
+                $data = unserialize($trimmed);
+            }
 
             if ($wrkarounds) {
                 echo Cache::getWorkarounds(
diff --git a/libraries/src/Cache/Controller/OutputController.php b/libraries/src/Cache/Controller/OutputController.php
index ebabe9feb9986..f0518d5d21729 100644
--- a/libraries/src/Cache/Controller/OutputController.php
+++ b/libraries/src/Cache/Controller/OutputController.php
@@ -68,7 +68,16 @@ public function get($id, $group = null)
         // Check again because we might get it from second attempt
         if ($data !== false) {
             // Trim to fix unserialize errors
-            $data = unserialize(trim($data));
+            $trimmed = trim($data);
+
+            // Try secure deserialization first
+            $data = @unserialize($trimmed, ['allowed_classes' => false]);
+
+            // Fallback for backward compatibility: if secure unserialize failed and the serialized data is not boolean false
+            if ($data === false && $trimmed !== 'b:0;') {
+                // Legacy fallback to preserve existing cache entries that store objects
+                $data = unserialize($trimmed);
+            }
         }
 
         return $data;
diff --git a/libraries/src/Cache/Controller/PageController.php b/libraries/src/Cache/Controller/PageController.php
index 84ec92c1f8dc5..5c51f35a9b307 100644
--- a/libraries/src/Cache/Controller/PageController.php
+++ b/libraries/src/Cache/Controller/PageController.php
@@ -97,7 +97,16 @@ public function get($id = false, $group = 'page')
                 $this->cache->unlock($id, $group);
             }
 
-            $data = unserialize(trim($data));
+            $trimmed = trim($data);
+
+            // Try secure deserialization first
+            $data = @unserialize($trimmed, ['allowed_classes' => false]);
+
+            // Fallback for backward compatibility: if secure unserialize failed and the serialized data is not boolean false
+            if ($data === false && $trimmed !== 'b:0;') {
+                // Legacy fallback to preserve existing cache entries that store objects
+                $data = unserialize($trimmed);
+            }
             $data = Cache::getWorkarounds($data);
 
             $this->_setEtag($id);
diff --git a/libraries/src/Cache/Controller/ViewController.php b/libraries/src/Cache/Controller/ViewController.php
index efa85daffdf78..e46b0c0e4ff6e 100644
--- a/libraries/src/Cache/Controller/ViewController.php
+++ b/libraries/src/Cache/Controller/ViewController.php
@@ -65,7 +65,16 @@ public function get($view, $method = 'display', $id = false, $wrkarounds = true)
                 $this->cache->unlock($id);
             }
 
-            $data = unserialize(trim($data));
+            $trimmed = trim($data);
+
+            // Try secure deserialization first
+            $data = @unserialize($trimmed, ['allowed_classes' => false]);
+
+            // Fallback for backward compatibility: if secure unserialize failed and the serialized data is not boolean false
+            if ($data === false && $trimmed !== 'b:0;') {
+                // Legacy fallback to preserve existing cache entries that store objects
+                $data = unserialize($trimmed);
+            }
 
             if ($wrkarounds) {
                 echo Cache::getWorkarounds($data);