CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

DEBIAN-CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

EUVD-2026-69250

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

CVE-2026-83557

jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...

PT-2026-84291

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

Malicious code in comparable_dormouse_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01029bf5cad48a4efb9f84dd25e81a2ef705a98d3b399161d3c01d62613ffa18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-106027

Malicious code in comparablemarsupialz3n npm...

EUVD-2025-92695

Malicious code in comparablemoosez3n npm...

EUVD-2025-77297

Malicious code in comparableworm-appteadev npm...

Malicious code in comparable_mole_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8499f52a187d599ad9c72ff1cf214fb0e6733cdd877c5e30170021c47cfaba7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-82441

Malicious code in comparableostrich0xrequest npm...

EUVD-2025-82443

Malicious code in comparablebuzzardreplicateautomation npm...

EUVD-2025-64892

Malicious code in comparablespiderz3n npm...

EUVD-2025-64891

Malicious code in comparabletiglonz3n npm...

MAL-2025-93661 Malicious code in comparable_rabbit_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 158aefe94f7b1e0f3ca5964a3a776e7473073fbdffbd40ed5225837973ace4ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64890

Malicious code in comparablevicunaz3n npm...

EUVD-2025-64894

Malicious code in comparableelkz3n npm...

Malicious code in comparable_silkworm_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98c0e4a1e1404f7728f6b1d5120e607cbcd7a796267865e0a2f635120f1a98e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...