Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution

Apache HertzBeat versions before 1.6.0 use a vulnerable version of the SnakeYAML library to parse YAML files imported through the /api/monitors/import and /api/alert/defines/import endpoints. An authenticated user can submit a YAML file that constructs an org.h2.jdbc.JdbcConnection with a malicio...

cve-2025-53770-research

cve-2025-53770-research 🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day CVE-2025-53770. 🕵️‍♂️ Covers root-cause deserialization flaws, attack timelines, risk metrics, and defensive EDR validation playbooks. 🛡️ 🕵️ CVE-2025-53770 — SharePoint "ToolShell" ゼロデイ調査...

React2Shell_CVE-2025-55182

CVE-2025-55182 WAFバイパス付きモジュラー型エクスプロイト 脆弱なReact Server ComponentsおよびNext.jsアプリケーションにおける重大なRCE脆弱性（CVE-2025-55182）を悪用するためのインタラクティブシェルを提供するPythonスクリプトです。 このエクスプロイトは、認証なしのリモートコード実行を可能にする逆シリアル化の欠陥を標的とします。WAFバイパス技術を追加するためのモジュラーシステムを備えています。 !NOTE...

WS_FTP Server - Insecure Deserialization

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. id: CVE-2023-40044 info: name: WSFTP Server - Insecure...

CVE-2023-43208-PoC

Mirth Connect RCE 익스플로잇 CVE-2023-43208 이 스크립트는 Mirth Connect 4.4.1 이전 버전의 원격 코드 실행RCE 취약점에 대한 개념 증명PoC입니다. API를 통해 XStream 역직렬화 취약점을 악용합니다. 요구 사항 Python 3.10 이상 3.13 호환 가능 대상에 대한 네트워크 연결 도구 사용법 python3 CVE-2023-43208.py -u https://IP-대상 -lh 공격자-IP -lp 포트 설치 가상 환경 사용을 권장합니다: python3 -m venv venv...

CVE-2025-55182

CVE-2025-55182 스캐너 CVE-2025-55182 에 대한 개념 증명 스캐너로, React Server ComponentsRSC의 중요한 인증되지 않은 원격 코드 실행RCE 취약점입니다. 개요 2025년 12월 3일, React Server Components를 사용하는 React 19.x 및 Next.js 애플리케이션에 영향을 미치는 중요한 취약점이 공개되었습니다. 이 결함은 RSC "Flight" 프로토콜의 역직렬화 로직에 존재하며, 공격자가 조작된 HTTP 요청을 통해 서버에서 임의의 코드를 실행할 수 있게...

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

CVE-2026-67399

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code...

Astra Linux – Vulnerability in Apache Log4j1.2

CVE-2020-9493 identified a deserialization issue present in Apache Chainsaw. Prior to Chainsaw V2.0, Chainsaw was a component of Apache Log4j 1.2.x, and the same issue still exists there...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in GLib. The deserialization of GVariant is vulnerable to an exponential blowup issue, where a malicious GVariant can cause excessive processing, resulting in a denial of service...

Astra Linux – Vulnerability in libjackson-json-java

A deserialization flaw was discovered in the Jackson-Databind library in versions prior to 2.8.10 and 2.9.1. This flaw could allow an unauthenticated user to execute arbitrary code by sending maliciously crafted input to the readValue method of the ObjectMapper class. This issue extends the...

Astra Linux – Vulnerability in libjackson-json-java

A deserialization flaw was discovered in the Jackson-Databind library, in versions prior to 2.6.7.1, 2.7.9.1, and 2.8.9. This flaw could allow an unauthenticated user to execute arbitrary code by sending maliciously crafted input to the readValue method of the ObjectMapper...

Astra Linux – Vulnerability in Jackson-Databind

A deserialization flaw was discovered in Jackson-Databind through version 2.9.10.4. This flaw could allow unauthenticated users to execute code via Ignite-JTA or Quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and...

CVE-2026-88048

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the deserialized layer scalars ni and no against the weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVector in...

CVE-2026-88048

A flaw was found in Tesseract. The FullyConnected::DeSerialize function does not properly validate the dimensions of deserialized layers against the weight-matrix dimensions. This vulnerability allows a remote attacker to provide a specially crafted .traineddata file, leading to a heap...

Linux Distros Unpatched Vulnerability : CVE-2026-88048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in src/lstm/fullyconnected.cpp does not validate the...

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate a...

The vulnerability of the iptfsDestroyState() function in the net/xfrm/xfrm_iptfs.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the iptfsDestroyState function in the net/xfrm/xfrmiptfs.c module, which is part of the Linux kernel’s networking functions, is related to deficiencies in the deserialization mechanism due to insufficient protection of service data. Exploiting this vulnerability could allow a...

CVE-2025-55182_CVE-2025-66478

CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...