293 matches found
CVE-2026-59242
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
EUVD-2026-57312
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
CVE-2026-59242
Apache Airflow vulnerability CVE-2026-59242: The XCom GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint can deserialize a string-literal payload via BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard, enabling an authenticated API user with XCom write-and-read acc...
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2026-10571)
Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by a denial of service caused by insecure...
PT-2026-71140
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow. classes on the API server. This occurs because the GET /api/v2/.../xcomEntries/key?deserialize=true...
CVE-2026-48397 Lightroom Classic | Deserialization of Untrusted Data (CWE-502)
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that...
CVE-2026-48397
CVE-2026-48397 affects Lightroom Classic and involves a Deserialization of Untrusted Data vulnerability that could enable arbitrary code execution in the context of the current user. The underlying issue is triggered when a user opens a malicious file, requiring user interaction. The attack surfa...
CVE-2026-48397 Lightroom Classic | Deserialization of Untrusted Data (CWE-502)
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that...
EUVD-2026-56430
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
PT-2026-70758
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an...
PT-2026-40125
Name of the Vulnerable Software and Affected Versions Ludwig framework versions prior to 0.10.5 Description The model serving component is subject to insecure deserialization. When initiating a model server via the ludwig serve command, the framework utilizes the torch.load function to load model...
flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism
The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 2025-13-04 contains an insecure deserialization vulnerability CWE-502 in its checkpoint loading mechanism. The loadcheckpoint function in checkpoint.py and the checkpoint loading code in eval.py use...
CVE-2021-22777
A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file...
Malicious code in elf-stats-flickering-lantern-502 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebc613b513833195464938e6e5c51e891b1a9978f9648ee11ec41bb76519e2d2 The package elf-stats-flickering-lantern-502 was found to contain malicious code...
MAL-2025-192332 Malicious code in elf-stats-flickering-lantern-502 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebc613b513833195464938e6e5c51e891b1a9978f9648ee11ec41bb76519e2d2 The package elf-stats-flickering-lantern-502 was found to contain malicious code...
Malicious code in elf-stats-festive-wreath-502 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23cf502be6558f6cdee55cfa362f50b7dc6877d994c9901ba28a31ac1b70cc37 The package elf-stats-festive-wreath-502 was found to contain malicious code...
MAL-2025-192032 Malicious code in elf-stats-festive-wreath-502 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23cf502be6558f6cdee55cfa362f50b7dc6877d994c9901ba28a31ac1b70cc37 The package elf-stats-festive-wreath-502 was found to contain malicious code...