EUVD-2022-34699

Malicious code in bioql PyPI...

EUVD-2024-33280

Malicious code in bioql PyPI...

EUVD-2022-7122

Malicious code in bioql PyPI...

EUVD-2024-16446

Malicious code in bioql PyPI...

EUVD-2025-16265

Malicious code in bioql PyPI...

EUVD-2025-17641

Malicious code in bioql PyPI...

EUVD-2025-18684

Malicious code in bioql PyPI...

PMTicket Project-Management-Software 代码问题漏洞

PMTicket Project-Management-Software is a PMTicket open source agile project management and issue tracking system. A code issue vulnerability exists in PMTicket Project-Management-Software, which stems from incorrect manipulation of the parameter userid of the component Cookie Handler in the file...

CVE-2025-10974

The CVE-2025-10974 entry concerns giantspatula SewKinect Endpoint.calculate where the vulnerable code path uses pickle.loads on the argument body_parts/point_cloud, enabling deserialization. Affects the Endpoint calculate file; remote manipulation is possible and the exploit has been publicly dis...

CVE-2025-10950

A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack...

VLA-RL 代码问题漏洞

VLA-RL is a visual language action model by the individual developer of lgx. A code issue vulnerability exists in VLA-RL, which stems from misuse of the parameter Message in the file experiments/robot/bridge/reasoningserver.py, which could lead to a deserialization attack...

ML-Logger 安全漏洞

ML-Logger is a logger, server and visualization dashboard for machine learning projects by Ge Yang Personal Developer. A security vulnerability exists in ML-Logger acf255bade5be6ad88d90735c8367b28cbe3a743 and prior versions, which stems from an incorrect manipulation of the parameter data of the...

SewKinect 代码问题漏洞

SewKinect is a paper pattern drawing software by the individual developer Cass Malloy. SewKinect suffers from a code issue vulnerability that stems from incorrect manipulation of the parameter bodyparts/pointcloud in the file/calculate, which could lead to a deserialization attack...

Exploit for Deserialization of Untrusted Data in Microsoft

LetsDefend-...

H2O 安全漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A security vulnerability exists in H2O 3.46.08 and earlier versions, which stems from an incorrect manipulation of the parameter connectionurl in the file /99/ImportSQLTable in the H2 JDBC Driver...

WordPress plugin Ninja Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

VulnCheck KEV: CVE-2022-22957

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities CVE-2022-22957 & CVE-2022-22958. A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote...

PT-2025-35650

Name of the Vulnerable Software and Affected Versions: FreeScout versions 1.8.185 and earlier Description: FreeScout is a help desk and shared inbox built with PHP’s Laravel framework. Versions prior to 1.8.186 contain a deserialization of untrusted data issue that allows authenticated attackers...

CVE-2025-57773 Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability...

CVE-2025-50461

A deserialization vulnerability exists in Volcengine's verl 3.0.0, specifically in the scripts/modelmerger.py script when using the "fsdp" backend. The script calls torch.load with weightsonly=False on user-supplied .pt files, allowing attackers to execute arbitrary code if a maliciously crafted...