36632 matches found
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CLEANSTART-2026-KA44549 jackson-databind's deserializer for java
CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...
CLEANSTART-2026-YH31321 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
CLEANSTART-2026-ET86830 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
PT-2026-102945
Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An issue exists in the SAML single sign-on session handling samld where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the...
PT-2026-102787
Name of the Vulnerable Software and Affected Versions MobilityDB versions prior to 1.3.1 Description An out-of-bounds read exists in the MEOS binary and library WKB deserialization logic. Unprivileged database users can cause a remote denial-of-service condition, crashing the PostgreSQL backend...
CVE-2026-101169: Deserialization of Untrusted Data
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
PT-2026-102457
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...
PT-2026-102935
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description The router profiler service contains a flaw that allows remote code execution when the application is started with the --enable profiling flag. The service exposes an unauthenticated RPyC server wit...
CVE-2026-103040: Deserialization of Untrusted Data
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...
PT-2026-102936
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache...
CVE-2026-103041: Deserialization of Untrusted Data
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...
PT-2026-102633
Name of the Vulnerable Software and Affected Versions Amazon GluonTS versions prior to 0.17.0 Description Deserialization of untrusted data in the model loading component allows context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process b...
CVE-2026-100308: Deserialization of Untrusted Data
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...
EUVD-2026-69250
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types incomplete PolymorphicTypeValidator denylist...
GHSA-Q4XH-88C3-WMH7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS
Summary jackson-databind 3.2.1 deserializes a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue / newXMLGregorianCalendarvalue. Per the XML-Schema lexical grammar these factory...
EUVD-2026-68961
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution...
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...
GHSA-WJGM-6HV5-3CVF jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution
Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...