EUVD-2026-57786

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' through the OnmsJexlUberspect.getMethod method in the Measurements REST API. An attacker can load arbitrary Java classes on the server by submitting a...

CVE-2026-73583: Out-of-bounds Read

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

PT-2026-71458

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

Linux Distros Unpatched Vulnerability : CVE-2026-73583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's...

undici: undici: Integrity failure due to caching of unsafe HTTP method responses

A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without...

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

GHSA-FCMM-42R9-MMMM Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-17095

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

CVE-2026-17095

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

CVE-2026-17095 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

EUVD-2026-57352

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

CVE-2026-17095 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection...

CVE-2026-17095

IBM i versions 7.3–7.6 are affected by CVE-2026-17095 due to unsafe reflection, allowing remote authenticated attackers to bypass security restrictions. The IBM Security Bulletin lists additional Navigator for i vulnerabilities in the same family. Affected products: IBM i 7.3, 7.4, 7.5, 7.6. Impa...

CVE-2026-73325

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with...

CVE-2026-73325

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with weightsonly=False,...

CVE-2026-73325 Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with...

CVE-2026-73325 Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization

Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with...

EUVD-2026-57313

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.loadquantizedmodelpt unconditionally calls torch.load with weightsonly=False,...

undici: undici: Integrity failure due to caching of unsafe HTTP method responses

A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without...