CVE-2024-0507_CVE-2024-0200-github

Intro This repository contains exploits we have developed for GitHub Enterprise vulnerabilities CVE-2024-0507 and CVE-2024-0200. Check out the full writeup at https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/ CVE-2024-0507 Privilege...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind, due to issues with the DefaultBaseTypeLimitingValidator and deserializer for java.nio.file. Jackson-databind is used in our Speech microservices. These...

CVE-2026-111851

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068...

EUVD-2026-108071

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068...

CVE-2026-111851

The Royal Elementor Addons WordPress plugin (versions

CVE-2026-111851 WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the ResolvesJsonApiElements trait in JSON:API resource loading, where an attacker with read-only...

EUVD-2026-107404

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a...

CVE-2026-92206

The CrewAI crewAI Framework is vulnerable to a Remote Code Execution (RCE) flaw due to unsafe reflection within the load_agent_from_repository function. The software fails to properly restrict or allowlist user-supplied arguments before importing modules from a repository. An attacker can exploit...

Security Bulletin: Due to the use of Jackson Core and Jackson Databind, multiple vulnerabilities are found in CICS Transaction Gateway Desktop Edition.

Summary Due to the use of Jackson Core and Jackson Databind, CICS Transaction Gateway Desktop Edition is vulnerable to Uncontrolled Resource Consumption CVE-2026-89407, CVE-2026-89425, CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, Deserialization of Untrusted Data CVE-2026-83557 and Use of...

Security Bulletin: IBM Guardium Data Protection is affected by security vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary IBM Guardium Data Protection has addressed security vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

CVE-2026-71253

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253

A vulnerability in Apache Johnzon (versions 1.0.0 to before 2.2.0) allows a remote attacker to potentially execute arbitrary code by submitting a crafted JSON payload. The root cause is unsafe reflection within the ClassConverter component, where it loads and statically initializes an attacker-sp...

EUVD-2026-104193

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-71253: Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

PT-2026-117336

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-97666

Sonatype Nexus Repository 3 is vulnerable to unsafe reflection via an ExtDirect endpoint . An unauthenticated remote attacker can provide controlled input to a Java class loading call, which allows them to determine if specific classes are present in the application. This vulnerability does not p...