PT-2026-97026

Name of the Vulnerable Software and Affected Versions YARA version 4.5.8 Description An invalid pointer release occurs during the deserialization of compiled .yrc rule files. The issue stems from insufficient validation of external-variable pointers, which can result in an invalid free within the...

EUVD-2026-84849

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

PT-2026-96837

Name of the Vulnerable Software and Affected Versions Sentry versions 23.11.0 through 26.6.0 Description Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field during the import of a user-supplied relocation archive. An authenticated user can craft a...

The vulnerability of the Unmarshal function in the go-yaml library, a programming language, is related to deficiencies in the deserialization mechanism, which allows attackers to trigger a denial-of-service attack.

The vulnerability of the Unmarshal function in the go-yaml library for the Go programming language is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091415)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091415 advisory. FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorph...

CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

PT-2026-96920

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An OS command injection exists in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific...

Security Bulletin: NVIDIA NeMo Speech - September 2026

NVIDIA has released a software update for NVIDIA® NeMo Speech. To protect your system, clone or update this software to version 3.0 or later from NVIDIA-NeMo/Speech on GitHub. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security...

PT-2026-97076

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An adjacent-network attacker could execute arbitrary code due to the deserialization of untrusted data. Deserialization is the process of...

PT-2026-96786

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description MISP registers the PHP phar stream wrapper in its web and console entry points. This wrapper causes PHP to treat phar archives as directories, leading to two security risks: any filesystem...

PT-2026-97046

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1.0 Description An authenticated non-guest user can execute arbitrary code via Java deserialization at the '/invoker/' HTTP invoker endpoint. The issue occurs because the class-name denylist enforced by...

CVE-2026-24267: Deserialization of Untrusted Data

NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information...

CVE-2026-24239: Deserialization of Untrusted Data

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...

CVE-2026-95806: Deserialization of Untrusted Data

MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper causes PHP to treat a phar archive as a directory, which has two security consequences: - any filesystem operation on a caller-influenced path that resolves to a...

CVE-2026-93088: Deserialization of Untrusted Data

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages direct...

CVE-2026-19658: Deserialization of Untrusted Data

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-28325: Deserialization of Untrusted Data

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

PT-2026-97100

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift versions 4.0.6.0 through 4.0.10.0 Description Improper deserialization of untrusted data allows a remote attacker to execute arbitrary code. Deserialization is the process of convertin...

CVE-2026-17637: Deserialization of Untrusted Data

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2026-65179: Deserialization of Untrusted Data

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information...