CVE-2025-9121

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods...

Security Bulletin: React Server Components RCE (CVE-2025-55182) and related advisories

Summary React Server Components RCE vulnerability. Carbon React and related Carbon React based libraries are not related to this CVE. However, many product teams may depend on the affected libraries via frameworks or plugins. We strongly encourage all teams to verify and upgrade any affected...

EUVD-2025-203814

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution...

CVE-2025-33210

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution...

Deserialization of Untrusted Data

Overview isaaclab is an Isaac Lab Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization process. An attacker can achieve arbitrary code execution by providing specially crafted data to be deserialized. Details Serialization is a process of...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.js React2Shell CVE-2025-55182 Expl0it A proof-of-conce...

CVE-2025-33210

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution...

CVE-2025-33210

CVE-2025-33210 affects NVIDIA Isaac Lab. Multiple connected sources confirm a deserialization vulnerability in Isaac Lab that can lead to arbitrary code execution when untrusted data is deserialized. Impact is tied to versions prior to 2.3.0; upgrading Isaac Lab to 2.3.0 or later is the recommend...

CVE-2025-33210

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution...

CVE-2025-33210

NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution...

CVE-2025-14606

A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickleconvert.go of the component Pickle Decoding. The manipulation leads to deserialization. The attack can be initiated remotely. A high degree of...

Security Bulletin: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data vulnerable to Deserialization of Untrusted Data due to jackson-core

Summary jackson-core is used by IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data in the repo huts-common Vulnerability Details WSID: WS-2022-0468 DESCRIPTION: The jackson-core package is vulnerable to a Denial of Service DoS attack. The methods in the classes listed below fail to...

Exploit for Deserialization of Untrusted Data in Facebook React

No d...

CVE-2025-13439

The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpdcustomuplodfile' AJAX action, which flows...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.js CVE-2025-55182 Proof of Concept This is a proof-of-co...

CVE-2025-65213

MooreThreads torchmusa through all versions contains an unsafe deserialization vulnerability in torchmusa.utils.comparetool. The compareforsingleop and naninftrackforsingleop functions use pickle.load on user-controlled file paths without validation, allowing arbitrary code execution. An attacker...

NVIDIA Isaac Lab 代码问题漏洞

NVIDIA Isaac Lab is a robotics learning framework from NVIDIA. NVIDIA Isaac Lab suffers from a code issue vulnerability that stems from a deserialization vulnerability that could lead to code execution...

Fickling has Code Injection vulnerability via pty.spawn()

Fickling Assessment Based on the test case provided in the original report below, this bypass was caused by pty missing from our block list of unsafe module imports as previously documented in 108, rather than the unused variable heuristic. This led to unsafe pickles based on pty.spawn being...

Deserialization of Untrusted Data

Overview fickling is an A static analyzer and interpreter for Python pickle data Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to incomplete detection of dangerous pickle constructs. The safety analysis fails to block certain unsafe module imports,...

GHSA-R7V6-MFHQ-G3M2 Fickling has Code Injection vulnerability via pty.spawn()

Fickling Assessment Based on the test case provided in the original report below, this bypass was caused by pty missing from our block list of unsafe module imports as previously documented in 108, rather than the unused variable heuristic. This led to unsafe pickles based on pty.spawn being...