11905 matches found
CVE-2026-72649
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
EUVD-2026-69562
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-72649
This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-72649
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...
Security Bulletin: Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management
Summary Multiple vulnerabilities found in logback-core jar which is part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...
PT-2026-84388
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...
PT-2026-84465
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...
CVE-2026-71981: Deserialization of Untrusted Data
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-72649: Deserialization of Untrusted Data
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-82226
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-82226
This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...