SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

CVE-2026-68771_exploit

CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserialization RCE Unauthenticated remote code execution in ComfyUI via the LoadTrainingDataset node. LoadTrainingDataset.execute loads dataset shards from the server's output directory with torch.loadf and noweightsonly=True. On PyTorch /tmp/pwned...

CVE-2025-68664-LangGrinch-PoC

📑 Table of Contents 🎯 Executive Summary 📂 Project Structure 🚀 Quick Start 🐛 Vulnerability Deep Dive 🔬 Technical Root Cause Analysis ⚔️ Attack Chain Methodology 💀 Payload Arsenal 55+ 🎮 Operator's Strategy Guide...

openmeetings-cluster-openjpa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-cluster-openjpa Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-cluster-openjpa Class: CWE-502 Reach: Remote Apache OpenMeetings 9.1.0. Leftover of CVE-2024-54676 doc...

cve-2017-5941-poc-docker-lab

CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...

langgrinch-cve-2025-68664-analysis

LangGrinch Vulnerability Analysis: CVE-2025-68664 Overview This repository contains a technical report analyzing CVE-2025-68664, also known as LangGrinch, a serialization injection vulnerability affecting LangChain Core. The report explains the vulnerability background, root cause, exploitation...

CVE-2026-50522

🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation Critical SharePoint Deserialization Vulnerability Under Active Exploitation Created by Pratik Chhetri Report Date: 2026-07-27 📌 Executive Snapshot Field| Finding ---|--- Vulnerability| CVE-2026-50522 Product| Microsoft SharePoint Server...

CVE-2026-20131-Post-Incident-Written-Report

CVE-2026-20131-Post-Incident-Written-Report This post-incident report analyzes the exploitation of CVE-2026-20131, a critical zero-day unauthenticated Remote Code Execution RCE vulnerability in Cisco Secure Firewall Management Center FMC. The document covers the initial intrusion vector via Java...

CVE-2025-64512-pdfminer-PoC

CVE-2025-64512 — pdfminer.six CMapDB Deserialization PoC Proof-of-Concept for a deserialization vulnerability in pdfminer.six that leads to arbitrary code execution when parsing a crafted PDF. PURPOSE / LEGAL DISCLAIMER This repository is provided for educational and authorized security research...

cotonti-commentswidget-poc

Cotonti CommentsWidget PHP Object Injection PoC Safe local proof of concept for the PHP object injection issue identified in Cotonti's CommentsWidget implementation. Vulnerability Project: Cotonti Affected component: plugins/comments/inc/CommentsWidget.php CWE: CWE-502 — Deserialization of...

Exploit for CVE-2026-82384

CVE-2026-82384 — Apache Roller — десериализация без аутентифик...

CVE-2025-53770

CVE-2025-53770 Detection Project A comprehensive vulnerability detection toolkit for identifying systems vulnerable to CVE-2025-53770 CWE-502: Deserialization of Untrusted Data. 🔍 Overview This project provides enterprise-ready detection scripts to identify and assess systems potentially vulnerab...

Security Bulletin: Informix Cloud Pak - DMC vulnerablity

Summary Security Bulletin: Informix Cloud Pak DMC vulnerablity Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies...

NameTrap: Steering AI Coding Agents toward Security Vulnerabilities Via Variable Names

AI coding agents routinely clone repositories, install packages, and read source code obtained from the Web, so publicly hosted code becomes part of the context that shapes the code they write. We show that this Web-borne context can be weaponized without any explicit instruction. We present...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2026-10571)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of...

Security Bulletin: A Security Vulnerability in Apache MINA Core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-94301)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-94301 DESCRIPTION: The fix for CVE-2026-47065/ZDRES-232 "resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy",...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied...

CVE-2026-44963

CVE-2026-44963 — Veeam Backup & Replication RCE Forschungs-Repository vonSentinelX — nur für autorisierte Sicherheitstests und defensive Zwecke. Übersicht Feld| Detail ---|--- CVE ID| CVE-2026-44963 Anbieter| Veeam Produkt| Backup & Replication Betroffene Versionen| 12.3.2.4854 alle v12-Builds...

Security Bulletin: Multiple security vulnerabilities have been identified in Python packages shipped with IBM Guardium Cryptography Manager (GCM)

Summary Multiple security vulnerabilities identified in Python packages shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-48775 DESCRIPTION: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB...