29591 matches found
(0Day) Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deserializemessage function. The issue results from the lack of proper...
PT-2026-2003
Name of the Vulnerable Software and Affected Versions Upsonic affected versions not specified Description A remote code execution issue exists in Upsonic due to deserialization of untrusted data. This allows for unauthenticated exploitation, potentially impacting systems that rely on the componen...
PT-2026-1994
Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is...
PT-2026-1992
Name of the Vulnerable Software and Affected Versions GPT Academic affected versions not specified Description A flaw exists in the stream daas function that allows remote attackers to execute arbitrary code on affected systems. This is due to insufficient validation of user-supplied data, leadin...
PT-2026-2002
Name of the Vulnerable Software and Affected Versions Langflow affected versions not specified Description A flaw exists in the disk cache service of Langflow that allows remote attackers to execute arbitrary code on affected installations. Authentication is required for exploitation. The issue...
(0Day) GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the runinsubprocesswrapperfunc function. The issue results from the lack of proper validati...
PT-2026-1990
Name of the Vulnerable Software and Affected Versions Foundation Agents MetaGPT affected versions not specified Description A flaw exists in the deserialize message function that allows remote attackers to execute arbitrary code on affected systems. Authentication is not required for exploitation...
(0Day) GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the...
picklescan has Arbitrary file read using `io.FileIO`
Summary Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data example: /etc/passwd to an external server. Details...
GHSA-9726-W42J-3QJR picklescan has Arbitrary file read using `io.FileIO`
Summary Unsafe pickle deserialization allows unauthenticated attackers to read arbitrary server files and perform SSRF. By chaining io.FileIO and urllib.request.urlopen, an attacker can bypass RCE-focused blocklists to exfiltrate sensitive data example: /etc/passwd to an external server. Details...
Exploit for Deserialization of Untrusted Data in Facebook React
No d...
Exploit for Deserialization of Untrusted Data in Facebook React
🛠️ React2Shell - Simplifying React Exploitation Framework...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 React2Shell - Proof of Concept ⚠️ SECURIT...
CVE-2025-67911
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through = 4.11...
CVE-2025-67911 WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through = 4.11...
CVE-2025-67911 WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through = 4.11...
CVE-2025-67911
CVE-2025-67911 describes a Deserialization of Untrusted Data vulnerability in the Tribulant Software Newsletters newsletters-lite plugin. The WordPress/newsletters entry states unauthenticated Object Injection via deserialization, affecting Newsletters: from n/a through
Deserialization Of Untrusted Data
org.apache.nifi, nifi-asana-processors is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the use of unfiltered Java object serialization and deserialization in the GetAsanaObject Processor, which allows an attacker with access to the configured cache server to supply...
Security Bulletin: Remote Exploitable Java SE Serialization Weakness Causing Partial DoS, affects watsonx.data
Summary Vulnerability in Java SE component: Serialization. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of...
