CVE-2025-55182

CVE-2025-55182이 뭔가요? React2Shell이라고도 불리며 React Server Components의 구조적 결함으로 데이터를 역직렬화 할때 prototype pollution이 발생해 RCE를 할 수 있는 취약점을 말합니다. 영향받는 버전은 React 19.0.0, 19.1.0, 19.1.1, 19.2.0, Next.js 15.x15.0.0 15.5.6, 16.x16.0.0 16.0.6 이상 버전입니다...

cve-2025-66478_rce_vulnerable

shadcn/ui を使ったモダンブログ Next.js 16、React 19、shadcn/ui、Tailwind CSS で構築された、モダンでエレガントなブログです。 重要： 教育、テスト、および悪用を目的としてのみ作成された脆弱性のある Next JS プロジェクトです。本番環境へのインストールは推奨されません。ローカル環境または管理された環境のみを対象としています。 PoC root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x6...

Security Updates for Microsoft Publisher Products C2R (September 2026)

The Microsoft Publisher Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. CVE-2026-69742 - Deserialization of untrusted data ...

EUVD-2026-73785

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-61765

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61769

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61769). An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution , data tampering , and information disclosure . The...

EUVD-2026-69313

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61754

CVE-2026-61754 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7...

CVE-2026-61756

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

PT-2026-84335

Name of the Vulnerable Software and Affected Versions NVIDIA Megatron Bridge affected versions not specified Description An issue exists where an attacker could cause a deserialization of untrusted data. Deserialization is the process of converting a data format back into an object. A successful...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

NVIDIA Transformers4Rec load_model_trainer_states_from_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Transformers4Rec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-12720 Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present ...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

PT-2026-65013

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

CVE-2026-24232

NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...