37600 matches found
CVE-2026-67260: Deserialization of Untrusted Data
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...
CVE-2026-59242: Deserialization of Untrusted Data
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
CVE-2026-58076: Deserialization of Untrusted Data
Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...
CVE-2026-67579: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...
PT-2026-71126
Name of the Vulnerable Software and Affected Versions Apache Airflow version 3.3.0 Description Insecure deserialization in the Apache Airflow Scheduler allows for arbitrary module import, which can lead to remote code execution. Deserialization is the process of converting a data format back into...
WordPress Ajax Search Lite PHP Object Injection Vulnerability
WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...
WordPress 69: PHP Object Injection Vulnerability
WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress 69 Clothing has a PHP object injection vulnerability, which stems from the lack of security checks on deserialized data by the program. Attackers can exploit this vulnerability to...
Azure Service Bus Deserialization RCE
The vulnerability of Azure Service Bus, a cloud-based asynchronous messaging platform, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...
PT-2026-71084
Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.36.0 Description The Kubernetes provider connection test fails to properly validate kubeconfig content containing a legacy GCP auth-provider. Specifically, the kubeconfig contains exec auth function in...
CVE-2026-68756: Deserialization of Untrusted Data
A party with write access to stored session data may affect JFrog Artifactory under specific conditions...
PT-2026-71309
Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...
PT-2026-71125
Name of the Vulnerable Software and Affected Versions Apache Airflow version 3.3.0 Description In the awaiting input task state, the scheduler deserializes the next kwargs variable of a task instance without using an allow-list. A DAG author can manipulate this value via the task execution API to...
SUSE SLED15: libruby2_5-2_5 / ruby2.5 / ruby2.5-devel / ruby2.5-devel-extra / etc (SUSE-SU-2026:3556-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3556-1 advisory. This update for ruby2.5 fixes the following issue - CVE-2026-41316: erb: @init deserialization guard bypass via defmodu...
ROS-20260812-73-0037
The vulnerability of the XStream library used by Jenkins automation servers is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to replace HTTP requests, gain unauthorized access to the Script Console, execute arbitrary code, or...
PT-2026-71147
Name of the Vulnerable Software and Affected Versions OneCompression library version 1.2.0 Description An unsafe deserialization issue exists when the library processes a crafted model.pt checkpoint file. The function QuantizedModelLoader.load quantized model pt calls torch.load with the weights...
PT-2026-71140
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow. classes on the API server. This occurs because the GET /api/v2/.../xcomEntries/key?deserialize=true...
WordPress: A Williams PHP Object Injection Vulnerability
WordPress A Williams is a commercial WordPress theme designed for secretaries, personal assistants, administrative staff, and consulting companies. WordPress A Williams has a PHP object injection vulnerability, which stems from improper deserialization of untrusted data, allowing for PHP object...
CVE-2026-67587: Deserialization of Untrusted Data
Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...
CVE-2026-18634
An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 Build 9510.1044 and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affect...
