580 matches found
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
CVE-2026-59242
Apache Airflow versions prior to 3.3.1 are vulnerable to a deserialization of untrusted data (CWE-502) flaw. The GET /api/v2/{...}/xcomEntries/{key}?deserialize=true endpoint passes string-literal payloads through BaseXCom.deserialize_value without the _check_forbidden_xcom_keys guard. This allow...
PT-2026-71140
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow. classes on the API server. This occurs because the GET /api/v2/.../xcomEntries/key?deserialize=true...
CVE-2026-59242: Deserialization of Untrusted Data
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...
PT-2026-105506
Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserialize value without the check forbidden xcom keys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow...
GO-2026-5466 Unauthenticated backend instantiation in github.com/rclone/rclone
The operations/fsinfo remote control RC endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it e.g...
CVE-2026-63317
A flaw was found in Apache OpenNLP. This vulnerability allows an attacker to achieve arbitrary class instantiation by providing a specially crafted XML feature generator descriptor within a model archive or by supplying untrusted format names. While not direct remote code execution, successful...
CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-44416
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-44416
Apache Ranger versions
EUVD-2026-55250
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-67864
A flaw was found in open62541. A remote attacker can exploit a vulnerability in the NodeManagement type-instantiation logic component, leading to a denial of service DoS. This can make the affected system unavailable to legitimate users...
PT-2026-69430
Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description Remote Code Execution is possible through arbitrary class instantiation within the plugin-schema-registry component. Arbitrary class instantiation occurs when an application creates an instance...
CVE-2026-44416: Improper Control of Generation of Code
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-17593
Nexus Repository 3 (and legacy Nexus Repository 2) is affected by CVE-2026-17593 where an account with nexus:settings:update can submit arbitrary realm identifiers via an internal configuration API that doesn’t validate against registered realms. Unrecognized entries are persisted and reread via ...
CVE-2026-17593 Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration
An account holding the nexus:settings:update permission in Nexus Repository 3 or the equivalent nexus:settings permission in the legacy Nexus Repository 2 could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of...
