CVE-2023-54396 PocketMine-MP before 4.8.1 Server Crash via Banner NBT

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...

CVE-2023-54396 PocketMine-MP before 4.8.1 Server Crash via Banner NBT

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...

EUVD-2023-60626

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server...

RLSA-2026:64796 Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

valkey security, bug fix, and enhancement update

An update is available for valkey. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Valkey is an advanced key-value store. It is often referred to as a data...

RLSA-2026:64807 Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

valkey security, bug fix, and enhancement update

An update is available for valkey. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Valkey is an advanced key-value store. It is often referred to as a data...

Improper Handling Of Untrusted Message Headers

Spring Integration is vulnerable to improper handling of untrusted message headers. The vulnerability is due to the EmbeddedHeadersJsonMessageMapper deserializing embedded JSON headers into a Map and creating message headers without sanitizing or filtering untrusted header names by default, which...

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport EPP Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 CVSS...

Deserialization Protection Bypass

org.springframework.integration, spring-integration-jdbc is vulnerable to a deserialization protection bypass. The vulnerability is due to JdbcMessageStore.addAllowedPatterns... providing no effective protection when the store is configured as a Spring-managed bean, which allows an attacker to...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IB...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363

CVE-2026-11363 affects the Ninja Forms WordPress plugin (all versions ≤ 3.14.6) with an authenticated PHP Object Injection vulnerability. During form import, WPN_Helper::build_nf_cache() calls $action-&gt;get_settings(), triggering deserialization of untrusted input with no further user interacti...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

EUVD-2026-74608

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

CVE-2026-87083

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87083

A flaw was found in tile-ai tilelang. This vulnerability, located in the Kernel Cache component's KernelCache.loadkernelfromdisk function, allows a remote attacker to perform deserialization. This could lead to various impacts, such as arbitrary code execution or information disclosure, by...

EUVD-2026-74538

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...