CVE-2016-5983

CVE-2016-5983 IBM WebSphere deserializzazione di dati non affidabili - IBM WebSphere 7,8,8.5,9 Link alla fonte originale del writeup: https://techblog.mediaservice.net/2016/10/cve-2016-5983-ibm-websphere-deserialization-of-untrusted-data/ Titolo: IBM WebSphere deserializzazione di dati non...

CVE-2021-25641-Proof-of-Concept

The 0xDABB of Doom - CVE-2021-25641-Prova di concetto Apache/Alibaba Dubbo = 2.7.3 codice PoC per CVE-2021-25641 RCE tramite deserializzazione di dati non attendibili; colpisce le versioni = 2.7.6 con gadget differenti Trattato in dettaglio nell'articolo "The 0xDABB of Doom", pubblicato sul blog...

Astra Linux – Vulnerability in pyyaml

In PyYAML before version 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1, and the 'UnsafeLoader' has been introduced to maintain backward compatibility with this function...

Adobe ColdFusion - Pre-Auth Remote Code Execution

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-29300 info:...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

EUVD-2026-63755

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

EUVD-2026-63693

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

Microsoft Entra ID Deserialization of Untrusted Data Vulnerability

Microsoft Entra ID formerly known as Azure Active Directory contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network...

CVE-2026-77645

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-69836

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-77646

A Server-Side Request Forgery (SSRF) vulnerability affects PTC Windchill PDMLink and PTC FlexPLM , exploitable through the deserialization of untrusted data . An unauthenticated remote attacker can trigger the flaw over the network with no user interaction, resulting in high confidentiality impac...

CVE-2026-77646 Server Side Request Forgery (SSRF) vulnerability reported in Windchill

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77645 Critical Remote Code Execution (RCE) vulnerability reported in Windchill

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77645

CVE-2026-77645 is a critical remote code execution (RCE) vulnerability in PTC Windchill and PTC FlexPLM , caused by deserialization of untrusted data . The CVSS 4.0 base score is 9.2 (CRITICAL) , with a network attack vector requiring no privileges and no user interaction . CISA's SSVC assessment...

CVE-2026-69836

CVE-2026-69836 is a CVSS 10.0 (Critical) deserialization of untrusted data vulnerability in Microsoft Entra ID (formerly Azure Active Directory), enabling an unauthorized attacker to achieve remote code execution over a network with no privileges or user interaction required. The vulnerability wa...

CVE-2026-15679

The vulnerability is in timm's checkpoint parsing code, which deserializes untrusted PyTorch checkpoint data without validation, enabling arbitrary code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). No affected ve...

EUVD-2026-63459

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...

CVE-2026-18285 Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-18285 Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-18285

The Aeon toolkit's load_rehab_pile_dataset method deserializes user-supplied data without validation, enabling arbitrary code execution in the process context. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). ZDI-CAN-28749. A fix commit exists at htt...