CVE-2026-92785

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...

CVE-2026-92785

Angel through 3.3.0 (a distributed machine learning framework by Tencent) deserializes the untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation, as seen in KryoUtils.java. An unauthenticated network attacker can send crafted serialized objects to the mast...

CVE-2026-92785 Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...

CVE-2026-92785 Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...

CVE-2026-20341 Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker...

CVE-2026-20341

CVE-2026-20341 is a critical deserialization flaw (CVSS 9.1) in the sftunnel inter-device communication protocol of Cisco Secure FMC Software . The root cause is unsecured deserialization of untrusted data over the sftunnel management connection. An authenticated remote attacker holding valid adm...

CVE-2026-20341 Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker...

CVE-2026-63128

A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. An unauthenticated remote attacker can send specially crafted JSON-RPC POST requests to the stateful Streamable HTTP server. These requests cause the server to create and permanently retain session and channel state without prop...

libevent: Libevent: Denial of Service via malformed RPC data

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

libevent: Libevent: Denial of Service via malformed RPC data

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

CVE-2026-73445

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

EUVD-2026-80317

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...

CVE-2026-92785: Deserialization of Untrusted Data

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint...

PT-2026-93789

Name of the Vulnerable Software and Affected Versions rmcp versions prior to 2.0.0 Description The stateful Streamable HTTP server in the rmcp crate contains a memory leak that can lead to a Denial of Service. An unauthenticated remote attacker can exploit this by sending a well-formed JSON-RPC...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Snapcast vulnerability (USN-8767-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8767-1 advisory. It was discovered that Snapcast incorrectly handled crafted JSON-RPC requests. A remote attacker could possibly use this issue to execute...

PT-2026-94062

Name of the Vulnerable Software and Affected Versions Angel versions prior to 3.3.1 Description The software deserializes untrusted setAlgoMetrics payloads using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust...

PT-2026-93399

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description An issue exists within the gRPC Network Security Interface gNSI Authz Rotate RPC that may allow an incorrect Authz policy, uploaded during an ongoing RPC stream, to become active. This iss...