PT-2026-98038

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description Deserialization of untrusted data in the command monitoring support allows class names embedded in document content to be honored during the construction of monitoring event object...

PT-2026-97845

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary code due to unsafe deserialization of untrusted data. Deserialization is the process of converting a data stream back into an...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-80513: Deserialization of Untrusted Data

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-82093: Deserialization of Untrusted Data

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data...

CVE-2026-63630: Deserialization of Untrusted Data

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf sends an...

CVE-2026-96745: Deserialization of Untrusted Data

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-96745

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

EUVD-2026-86285

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

Security update for ruby3.4 (important)

openSUSE security update: security update for ruby3.4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21878-1 Rating: important References: bsc1250016 bsc1255833 bsc1259239 bsc1262441 bsc1268011 bsc1268337 bsc1268338 bsc1268339 Cross-References:...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

Linux Distros Unpatched Vulnerability : CVE-2026-95897

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function fromnpystack of the file dask/array/core.py of the component Loader...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.6.0 Vulnerability Details CVEID:CVE-2026-59278 DESCRIPTION: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include...

CVE-2026-96775

MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

mlflow-pickle-rce Generic proof-of-concept for pickle deseria...

CVE-2026-96804 CVE-2026-96804

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

CVE-2026-96775

The MLflow machine learning platform is vulnerable to arbitrary remote code execution (RCE) due to a flaw in the dspy flavor (versions >= 2.0 ). The issue stems from a security control bypass where the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False setting is only enforced if the model_path ends in...

CVE-2026-96775 MLflow dspy bypasses pickle deserialization control

MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...