Undocumented-RCE-in-PLY — Updated!

Undocumented Remote Code Execution in PLY CVE‑2025‑56005 root@kitploit: CVE ID: CVE‑2025‑56005 Disclosure Date: July 1, 2025 Affected Product: PLY Python Lex‑Yacc Affected Version: 3.11 PyPI distribution Vendor: PLY Python Lex‑Yacc Affected Component: ply/yacc.py — LRTable.readpickle via...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of cached performance reports stored in the build directory on the controller. An attacker can execute arbitrary code by providing maliciously crafted serialized data,...

CVE-2026-82404

TOON is a compact, human-readable JSON serialization format for LLM prompts. Prior to 2.3.1 , decoding attacker-controlled TOON data with __proto__, constructor, or prototype keys wrote through the object prototype chain instead of creating own properties, polluting Object.prototype at runtime. T...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

EUVD-2026-70140

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84670

The Jenkins Performance Plugin (version 1015.v09ca_52b_3370e and earlier) is vulnerable to an arbitrary code execution attack due to an insecure deserialization flaw. The plugin uses Java serialization to cache performance reports in the build directory on the Jenkins controller but fails to rest...

EUVD-2026-70116

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...

CVE-2026-84650

In Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier ), a vulnerability exists where transient fields cannot be excluded from deserialization. This allows an attacker to submit configuration updates that specify values for these transient fields during deserialization, with the impact ...

CVE-2026-84646

The Jenkins automation server is vulnerable in versions 2.579 and earlier (and LTS 2.568.2 and earlier ). An attacker with Overall/Read permission can exploit a flaw where user objects appear as nested field values in other deserialized XML objects. By submitting crafted XML , the attacker can cr...

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...