CVE-2025-55182

什么是 CVE-2025-55182？ 也被称为 React2Shell，是指 React Server Components 的结构性缺陷，在反序列化数据时发生原型污染，从而导致能够执行 RCE 的漏洞。 受影响版本为 React 19.0.0, 19.1.0, 19.1.1, 19.2.0, Next.js 15.x（15.0.0 15.5.6）、16.x（16.0.0 16.0.6）及更高版本。...

Security Updates for Microsoft Publisher Products C2R (September 2026)

The Microsoft Publisher Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. CVE-2026-69742 - Deserialization of untrusted data ...

cve-2025-66478_rce_vulnerable

使用 shadcn/ui 的现代博客 一个使用 Next.js 16、React 19、shadcn/ui 和 Tailwind CSS 构建的现代优雅博客。 重要提示： Next JS 漏洞项目 ，仅为教育、测试和利用目的而创建，不建议在生产环境中安装，仅限本地或受控环境使用 PoC root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko...

EUVD-2026-73785

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-61765

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61769

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61769). An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution , data tampering , and information disclosure . The...

EUVD-2026-69313

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61754

CVE-2026-61754 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7...

CVE-2026-61756

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

PT-2026-84335

Name of the Vulnerable Software and Affected Versions NVIDIA Megatron Bridge affected versions not specified Description An issue exists where an attacker could cause a deserialization of untrusted data. Deserialization is the process of converting a data format back into an object. A successful...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

PT-2026-65013

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network...

PYSEC-2026-1654 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

CVE-2026-46590

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...