7734 matches found
Remote Code Execution (RCE)
Fugue is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe deserialization in the FlaskRPCServer implementation, where the decode function uses cloudpickle.loads on untrusted data, allowing attackers to send malicious serialized objects that execute arbitrary code on the...
Deserialization Of Untrusted Data
vLLM is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insufficient validation of user-supplied serialized tensors during loading, which allows an attacker to craft malicious inputs that trigger out-of-bounds memory writes and crash or compromise the server...
Deserialization Of Untrusted Data
Keras framework is vulnerable to Deserialization of untrusted data. The vulnerability is due to improper handling of maliciously crafted Keras files during deserialization, which allows an attacker to execute arbitrary code on an end user’s system by loading a file containing a TorchModuleWrapper...
Insecure Deserialization
cryptidy is vulnerable to insecure deserialization. The vulnerability is due to the use of pickle.loads on untrusted data in the aesdecryptmessage function within symmetricencryption.py, which allows an attacker to execute arbitrary code by supplying crafted serialized input...
Deserialization Of Untrusted Data
Drupal core is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper handling of object attributes, which allows an attacker to manipulate object properties and perform object injection...
Deserialization Of Untrusted Data
Dataease is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper validation of JDBC connection parameters in the MysqlConfiguration class, which allows an attacker to connect to a malicious MySQL server and execute arbitrary system commands through deserialization...
Exploit for Deserialization of Untrusted Data in Facebook React
No d...
CISA Software Acquisition Guide Supplier Response Web Tool XSS
RISK EVALUATION The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The...
Exploit for Deserialization of Untrusted Data in Facebook React
No d...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via insecure Hessian deserialization in the PD store. An attacker can execute arbitrary code by sending maliciously crafted data from a compromised or rogue Raft node. Details Serialization is a process...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 - React2Shell...
Deserialization of Untrusted Data
Overview @vitejs/plugin-rsc is a React Server Components RSC support for Vite. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process ...
Deserialization of Untrusted Data
Overview react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsaf...
Deserialization of Untrusted Data
Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe...
Deserialization of Untrusted Data
Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe...
Deserialization of Untrusted Data
Overview next is a react framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to enter an infinite loop and hang,...
Deserialization of Untrusted Data
Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to ent...
Deserialization of Untrusted Data
Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe...
Deserialization of Untrusted Data
Overview next is a react framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to enter an infinite loop and hang,...