CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-27172

camel-consul ConsulRegistry 反序列化漏洞复现工具（CVE-2026-27172） 本项目演示了 Apache Camel 的 camel-consul 组件（ConsulRegistry）中的一个 Java 反序列化漏洞 ，编号为 CVE-2026-27172 。它与 CVE-2024-22369 、CVE-2024-23114 和 CVE-2026-25747 属于同类问题，且在修复上述 CVE 时被遗漏。 公告：https://camel.apache.org/security/CVE-2026-27172.html 漏洞摘要 属性| 值 ---|---...

CVE-2026-71374 Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before...

CVE-2026-7861

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

CVE-2024-22369

CVE-2024-22369 致谢 本 PoC 基于华为开源管理中心陈子阳构建的复现程序 该复现程序经调整和清理后用于创建此 PoC，并增加了一些自动化功能。 环境准备 我们需要一个 Mysql 实例 docker run --name some-mysql -p 3306:3306 -e MYSQLROOTPASSWORD=my-secret-pw -e MYSQLDATABASE=db -d mysql 现在我们需要创建所需的表： 你有两个文件：employee.sql 和 employeecompleted.sql 运行以下命令： docker run -it --rm mysql...

CVE-2026-7861

A deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows remote attackers to achieve code injection . The affected versions are up to and including 07092026 . The vulnerability is rated CVSS 9.8 (Critical) with a network ...

Dubbo-deserialization

Apache Dubbo Deserialization Vulnerability Research This repository contains research materials, proof-of-concept code, and exploitation tools related to Apache Dubbo deserialization vulnerabilities, primarily focusing on CVE-2020-1948. Repository Structure Directories...

CVE-2025-55182-RCE-Exploit

CVE-2025-55182 的概念验证（POC） – Next.js 16.0.6 远程代码执行 此仓库包含一个针对 CVE-2025-55182 的有效概念验证（POC），该漏洞是影响 Next.js 16.0.6 的一个严重反序列化漏洞。 该利用滥用 $@ 块反序列化和 Chunk.prototype.then，以完全控制块解析过程，并在服务器上实现 任意代码执行（RCE） 。 漏洞摘要 Next.js 使用内部的 Chunk 对象以及一个用于服务器操作的流式/反序列化机制。 通过滥用 $@ 来反序列化一个 Chunk 引用 ，并将 Chunk.prototype.then...

Exploit for Deserialization of Untrusted Data in Facebook React

Penetration Testing Writeup: Next.js RCE & Node.js Inspector Pri...

CVE-2026-61775

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61778

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61772

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69330

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61761

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61752

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) ...

CVE-2026-61754

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69304

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...