37485 matches found
CVE-2026-73364: Deserialization of Untrusted Data
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
PT-2026-78823
Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description Improper access control allows a user with the schedule search capability to cause a scheduled search to load and deserialize a model file. This occurs because the apply search command is n...
ROS-20260819-73-0074
The vulnerability of the unserialize function in the MediaWiki software, which is used to implement the hypertext environment, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Linux Distros Unpatched Vulnerability : CVE-2026-63337
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...
Adobe Lightroom Classic Code Execution
The vulnerability of the Adobe Lightroom Classic graphic editor is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2026-70667
creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:16+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f 2026-08-19 08:31:37+00:00| seen| https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7...
Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2026-14512, CVE-2026-14528)
Summary IBM WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM WebSphere Remote Server (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
GHSA-WG9G-W2J2-8PGR MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
Summary The NumpyReader class in monai/data/imagereader.py unconditionally uses np.loadname, allowpickle=True line 1276, enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit 5b71547. The allowpickle...
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
Summary The NumpyReader class in monai/data/imagereader.py unconditionally uses np.loadname, allowpickle=True line 1276, enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit 5b71547. The allowpickle...
Deserialization of Untrusted Data
Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Deserialization of Untrusted Data via NumpyReader.read in monai/data/imagereader.py, which called numpy.load with allowpickle=True unconditionally. An attacker who can supply a malicious NPY...
GHSA-QXQ5-QHX6-94QW Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algofrompickle was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released 2026-01-29. All three pickle.loads calls remain unchanged. The fix was...
Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algofrompickle was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released 2026-01-29. All three pickle.loads calls remain unchanged. The fix was...
Deserialization of Untrusted Data
Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the algofrompickle function. An attacker can execute arbitrary code by supplying a crafted pickle file that is deserialized without proper validation...
DEBIAN-CVE-2026-69219
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...
UBUNTU-CVE-2026-69220
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...
DEBIAN-CVE-2026-63337
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...
CVE-2026-63337
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...
CVE-2026-63337
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...