Dubbo-deserialization

介绍 JNDI注入利用工具，生成JNDI链接并启动后端相关服务，可用于Fastjson、Jackson等相关漏洞的验证。 使用 可执行程序为jar包，在命令行中运行以下命令： root@kitploit: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C command -A address 其中: -C - 远程class文件中要执行的命令。 （可选项 , 默认命令是mac下打开计算器，即"open /Applications/Calculator.app"） -A - 服务器地址，可以是IP地址或者域名。 （可选项...

Astra Linux – Vulnerability in Jackson-Databind

In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...

Spring Data Commons - Remote Code Execution

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

CVE-2026-69694

Deserialization of untrusted data in Windows IP Address Management IPAM Service allows an authorized attacker to elevate privileges locally...

CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

CVE-2026-7861

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

CVE-2026-7861

A deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows remote attackers to achieve code injection . The affected versions are up to and including 07092026 . The vulnerability is rated CVSS 9.8 (Critical) with a network ...

Exploit for Deserialization of Untrusted Data in Facebook React

Penetration Testing Writeup: Next.js RCE & Node.js Inspector Pri...

CVE-2026-61775

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61778

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61772

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69330

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61761

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61752

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) ...

CVE-2026-61754

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69304

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...