Insecure Deserialization

picklescan is vulnerable to insecure deserialization. The vulnerability is due to the use of torch.utils.bottleneck.main.runcprofile function to execute remote pickle files, which allows an attacker to run arbitrary code...

PT-2025-37727

Name of the Vulnerable Software and Affected Versions: Apache Fory versions prior to 0.12.2 Description: A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service DoS. The issue is due to the insecure deserialization of untrusted data. An attacker can provide a large,...

SAP Netweaver Insecure Deserialization Vulnerability (3634501)

SAP NetWeaver is affected by an insecure deserialization vulnerability within the RMI-P4 module, when deserializing Java Objects. This could allow an un authenticated attacker to potentially, via malicious payload, to execute arbitrary OS commands. Note that Nessus has not tested for this issue b...

CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

ebram_web_scanner

EBRAM Web Scanner EBRAM Web Scanner is a powerful Python-ba...

CVE-2025-58367 DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution via...

Sitecore XP Insecure Deserialization (SC2025-005)

The version of Sitecore XP running on the remote host is affected by an insecure deserialization vulnerability. Sitecore deployments using the sample key provided with deployment instructions for XP 9.0 or earlier and Active Directory 1.4 are potentially vulnerable to an insecure ViewState...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Remote Code Execution RCE.This issue affects Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform XP: from 9.0 through 9.3, from 10.0 throu...

CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Remote Code Execution RCE.This issue affects Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform XP: from 9.0 through 9.3, from 10.0 throu...

Exploit for CVE-2025-53691

CVE-2025-53691: Remote code execution RCE through insecure...

Linux Distros Unpatched Vulnerability : CVE-2024-35515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code. CVE-2024-35515 Note that Nessus relies on the presence of the...

Exploit for CVE-2025-49113

CVE-2025-49113 – Roundcube Remote Code Execution RCE PoC Th...

Delta Electronics DTN Soft Code Execution Vulnerability

Delta Electronics DTN Soft is a temperature controller software from Delta Electronics China. A security vulnerability exists in Delta Electronics DTN due to an insecure deserialization flaw in the handling of project files. An attacker can exploit the vulnerability to execute arbitrary code on t...

Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass authentication and achieve remote code...

CVE-2025-34153

Hyland OnBase versions prior to 17.0.2.87 other versions may be affected are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in...

CVE-2025-8875 Insecure Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1...

Vulnerabilities fixed in N-able N-Central

N-able has fixed vulnerabilities in N-Central. The vulnerabilities include insecure deserialization that poses the risk of command execution, and command injection that stems from improper sanitization of user input. An attacker could exploit these vulnerabilities to execute unauthorized commands...

PT-2025-33361 · Undefined · Undefined

- CVE-2025-8875 is an insecure deserialization vulnerability that could lead to command execution - CVE-2028-8876 is a command injection vulnerability via improper sanitization of user input...

CVE-2025-34153

Hyland OnBase versions prior to 17.0.2.87 other versions may be affected are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in...