1828 matches found
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
Summary A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest versionv1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Details It exists an unsafe code segment in serde.py: Python def...
CVE-2025-27520
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...
CVE-2025-27520
BentoML 1.4.2 contains an insecure deserialization flaw in serde.py that enables unauthenticated RCE via crafted payloads. The issue, described across CVE-2025-27520 sources, is fixed in 1.4.3. Public PoCs and exploit modules exist (GitHub, Metasploit) illustrating remote command execution attemp...
Exploit for Deserialization of Untrusted Data in Apache Parquet_Java
CVE-2025-30065 Proof of Concept - Apache Parquet RCE FOR EDUC...
Bitdefender GravityZone Console 代码问题漏洞
Bitdefender GravityZone Console is a centralized cybersecurity management platform from Bitdefender Romania, designed to provide organizations with full visibility and control over their security infrastructure. A code issue vulnerability exists in Bitdefender GravityZone Console versions prior t...
BentoML RCE
A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in v1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Module Options msf use exploit/linux/http/bentoml/rcecve202527520 msf undefinedrcecve202527520 show...
PT-2025-14902
Name of the Vulnerable Software and Affected Versions BentoML versions 1.3.8 through 1.4.2 Description A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in BentoML. It allows any unauthenticated user to execute arbitrary code on the server. The...
BentoML 代码问题漏洞
BentoML is an open source modeling service library from BentoML Open Source. It is used to build high-performance and scalable AI applications using Python. A code issue vulnerability exists in BentoML version 1.3.4 through versions prior to 1.4.3, which stems from an insecure deserialization iss...
Remote Code Execution (RCE)
Horovod is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, which ultimately leads to insecure deserialization via cloudpickle.loadsdecoded. It allows an attacker to send a malicious pickle object...
VulnCheck KEV: CVE-2025-27218
Sitecore Experience Manager XM and Experience Platform XP 10.4 before KB1002844 allow remote code execution through insecure deserialization...
Applio 代码问题漏洞
Applio is an open source AI voice conversion tool from Spanish AI Hispano. A code issue vulnerability exists in Applio 3.2.8-bugfix and prior versions, which stems from an insecure deserialization issue in infer.py that could lead to remote code execution...
Applio 路径遍历漏洞
Applio is an open source AI speech conversion tool from Spanish AI Hispano. A path traversal vulnerability exists in Applio 3.2.8-bugfix and prior versions, which stems from an arbitrary file write issue in train.py, and could lead to the writing of arbitrary files on the Applio server, or in...
Applio 代码问题漏洞
Applio is an open source AI voice conversion tool from Spanish AI Hispano. A code issue vulnerability exists in Applio 3.2.8-bugfix and earlier versions, which stems from an insecure deserialization issue in inference.py that could lead to remote code execution...
Applio 代码问题漏洞
Applio is an open source AI speech conversion tool from Spanish AI Hispano. A code issue vulnerability exists in Applio 3.2.8-bugfix and prior versions, which stems from an insecure deserialization issue in modelblender.py that could lead to remote code execution...
vLLM 代码问题漏洞
vLLM is a high throughput and memory efficient inference and service engine for LLM from the vLLM open source. A code issue vulnerability exists in vLLM that stems from insecure deserialization in the Mooncake configuration that could lead to remote code execution...
Applio 代码问题漏洞
Applio is an open source AI speech conversion tool from Spanish AI Hispano. A code issue vulnerability exists in Applio 3.2.8-bugfix and prior versions, which stems from an insecure deserialization issue in modelinformation.py that could lead to remote code execution...