CVE-2026-69098

creationtimestamp| type| source ---|---|--- 2026-08-04 18:18:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbmqjj4lf2h 2026-08-06 12:00:10+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96881 2026-08-07 00:10:47+00:00| published-proof-of-concept|...

CVE-2026-69098 kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field wi...