CVE-2026-17156 IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-17156 IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-17156

CVE-2026-17156 affects IBM App Connect Enterprise (versions 13.0.1.0–13.0.8.0 and 12.0.1.0–12.0.12.27), allowing a local attacker with no privileges to execute arbitrary code through insecure deserialization (CWE-502). The attack requires user interaction and yields full compromise of confidentia...

EUVD-2026-77783

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-17416

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 and 12.0.1.0 through 12.0.12.27 are vulnerable to arbitrary code execution by a local attacker due to insecure deserialization (CWE-502). The IBM security bulletin groups this CVE with two additional vulnerabilities: CVE-2026-17133 (OS...

CVE-2026-17416 IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-17416 IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-61701

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-49400

October CMS (System module) prior to v3.7.17 and v4.2.21 is affected by a PHP object injection vulnerability in the backend SessionMaker trait, which stored widget session state as base64(serialize(...)) and deserialized it with unserialize() without an allowed_classes restriction. Exploitation r...

CVE-2026-61701

Laravel MagicLink (versions 2.0.0 through 2.25.1) is vulnerable to insecure deserialization of serialized action objects stored in the magic_links.action database column. The deserialization path in src/MagicLink.php and src/Actions/ResponseAction.php relies on an unsafe legacy unserialize() fall...

CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

EUVD-2026-77617

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

Vulnerability in Cosminexus

Overview Insecure deserialization vulnerability exists in Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory...

PT-2026-91433

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description Insecure deserialization allows a local attacker to execute arbitrary code. Deserialization is the proces...

PT-2026-91432

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description Insecure deserialization allows a local attacker to execute arbitrary code. Deserialization is the proces...

PT-2026-91720

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions...

PT-2026-91265

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

EUVD-2026-77001

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...