36632 matches found
c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...
EUVD-2026-89498
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...
EUVD-2026-89481
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
EUVD-2026-89482
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...
CVE-2026-13046
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...
CVE-2026-13046: Deserialization of Untrusted Data
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling samld allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a...
PT-2026-103568
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An issue exists in Kiteworks Email Protection Gateway clusters when database replication is enabled. A trusted party within the cluster can submit a crafted...
CVE-2026-102135: Deserialization of Untrusted Data
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execution as the gateway service account. Replication is disabl...
PT-2026-103598
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An authenticated administrator with specific queue-management privileges can submit a crafted serialized object to a cluster management interface. Because the...
CVE-2026-102108: Deserialization of Untrusted Data
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...
The vulnerability of the application’s database management component for processing and analyzing data with Splunk MCP Server allows a perpetrator to execute arbitrary commands.
The vulnerability of the application’s database management component for data processing and analysis in Splunk MCP Server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...
CVE-2026-102101: Deserialization of Untrusted Data
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depen...
AlmaLinux 9.2 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1722525083)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1722525083 advisory. - A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to...
CVE-2026-100512: Deserialization of Untrusted Data
Contributor PHP Object Injection in Nested Pages = 3.3.2 versions...
Telerik UI for ASP.NET AJAX 2011.2.712 < 2026.2.708 Multiple Vulnerabilities
The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2011.2.712 or later and prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language paramete...
Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1784135237)
The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784135237 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until...
AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1784135237)
The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784135237 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8...
WatchGuard FireWare OS samld SAMLSession Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability. The specific flaw exists within...