37037 matches found
CVE-2026-65772
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...
CVE-2026-47297
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...
CVE-2026-47864
A flaw was found in Spring Integration. The SerializingHttpMessageConverter component deserializes incoming HTTP request bodies without proper class filtering. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request. If a known Java deserialization 'gadget'...
CVE-2026-81385
Microsoft Office Publisher is affected by a deserialization of untrusted data vulnerability that allows an unauthorized, remote attacker to achieve remote code execution over a network with low complexity and no required privileges, though user interaction is required. The CVSS 3.1 score is 8.8 (...
EUVD-2026-73852
Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network...
CVE-2026-77484
CVE-2026-77484 is a remote code execution vulnerability in Microsoft SQL Server caused by deserialization of untrusted data , allowing an authorized attacker to execute code over a network. The CVSS v3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-explo...
EUVD-2026-73785
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...
CVE-2026-65772
CVE-2026-65772 is a deserialization of untrusted data flaw in Microsoft Dynamics 365 On-Premises that allows an authorized attacker (low privileges) to execute code over a network. The CVSS 3.1 score is 8.8 (High) with high impact to confidentiality, integrity, and availability, and no user inter...
EUVD-2026-73738
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...
CVE-2026-47297
Microsoft SQL Server is affected by a deserialization of untrusted data vulnerability that allows an unauthorized attacker to achieve remote code execution over a network . The vulnerability requires no prior authentication or user interaction but carries a High attack complexity , resulting in a...
EUVD-2026-73644
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...
EUVD-2026-73043
Deserialization of untrusted data in Windows IP Address Management IPAM Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69694
CVE-2026-69694 affects the Windows IP Address Management (IPAM) Service . The root cause is deserialization of untrusted data , which allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating tha...
GHSA-X99W-6FGC-PMFW NLTK: Allowlisted pickle loaders still permit code execution in current source
Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...
EUVD-2026-65440
NLTK: Allowlisted pickle loaders still permit code execution in current source...
NLTK: Allowlisted pickle loaders still permit code execution in current source
Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...
EUVD-2026-65229
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution...
GHSA-RHP5-R9X4-F5G2 NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...