Security Bulletin:IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data

Summary WmServiceMock is bundled with IBM webMethods Integration Server. Remediation steps are provided below CVE-2026-12118 Vulnerability Details CVEID:CVE-2026-12118 DESCRIPTION: IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system du...

CVE-2026-21655

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0...

CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0...

EUVD-2026-48423

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0...

CVE-2026-21655

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0...

CVE-2026-21655 C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0...

EUVD-2026-40847

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...

RLSA-2026:41894 Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29...

RLSA-2026:41899 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18...

RLSA-2026:41901 Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29...

PT-2026-64165

Name of the Vulnerable Software and Affected Versions victor versions 2.9 through 2.9 Description An issue exists in the Windows version of the software where the deserialization of untrusted data allows for CAPEC-586, which refers to the process of converting data from a stream or file back into...

RockyLinux 9 : .NET 10.0 (RLSA-2026:41898)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41898 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

RockyLinux 10 : .NET 9.0 (RLSA-2026:41895)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41895 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

RockyLinux 9 : .NET 8.0 (RLSA-2026:41894)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41894 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

MiracleLinux 8 : dotnet10.0-10.0.110-1.el8_10 (AXSA:2026-1334:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1334:13 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-11536)

Summary IBM WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and is vulnerable to a remote code execution vulnerability. Required fixes for affected WebSphere Application Server has been published in the security bulletin links below. Vulnerability Details...

CVE-2026-13190 PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary jackson-databind-2.21.2.jar and jackson-databind-3.1.2.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 . Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

PT-2026-63404

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description A deserialization issue in the persistence utilities allows unsafe type instantiation from an attacker-influenced persisted state, which can lead to remote code execution...

GHSA-5GVW-P9QM-JGWH jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

Summary UnwrappedPropertyHandler.processUnwrapped replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet with no prop.visibleInViewctxt.getActiveView guard — the exact guard processUnwrappedCreatorProperties received in the 5971 /...