EUVD-2025-179317

Malicious code in deserialize-rain-stub-alpha-socket npm...

EUVD-2025-179320

Malicious code in deserialize-book-cloud-awk-finally npm...

EUVD-2025-179378

Malicious code in decompress-deserialize-nu-new-emulate npm...

EUVD-2025-179749

Malicious code in chi-bad-deserialize-throw-static npm...

EUVD-2025-178443

Malicious code in import-scale-deserialize-sudo-visualize npm...

EUVD-2025-178905

Malicious code in final-bundle-zero-string-deserialize npm...

EUVD-2025-179211

Malicious code in easy-kernel-deserialize-public-await npm...

EUVD-2025-179623

Malicious code in compile-gamma-wind-code-deserialize npm...

EUVD-2025-176175

Malicious code in string-route-theta-virtualize-deserialize npm...

EUVD-2025-176079

Malicious code in table-rho-deserialize-authorize-test npm...

EUVD-2025-179141

Malicious code in encode-route-deserialize-eta-export npm...

EUVD-2025-176302

Malicious code in socket-table-grid-sigma-deserialize npm...

EUVD-2025-179416

Malicious code in daemon-old-mu-interpret-deserialize npm...

EUVD-2025-176423

Malicious code in serialize-final-beta-deserialize-await npm...

pkcs11-helper -- deserialize buffer overflow

Alon Bar-Lev reports: util: fix deserialize buffer overflow. thanks to Aarnav Bos...

EUVD-2025-31172

Malicious code in bioql PyPI...

EUVD-2022-0619

Malicious code in bioql PyPI...

Incorrect Authorization

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incorrect Authorization via the deserializecompact function. An attacker can bypass intended authorization policies by crafting a signed token with unknown critical head...

PT-2025-38752

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.4 Description Authlib’s JWS verification improperly handles tokens declaring unknown critical header parameters crit, violating RFC 7515 specifications. An attacker can create a signed token with a critical header...

EUVD-2025-30225

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection...