47 matches found
Exploit for Deserialization of Untrusted Data in Apache Tomcat
CVE-2025-24813 — Apache Tomcat Partial PUT Deserialization RCE...
CVE-2026-62263 OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Open Access Management OpenAM is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacke...
Security Bulletin: Vulnerabilities exists in IBM Netezza Software
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows...
Deserialization RCE
Spring Batch is vulnerable to deserialization RCE. The vulnerability is due to the JobParameterDeserializer not properly enforcing the trusted-types allowlist, where applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer from an untrusted job repository can...
CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...
CVE-2026-47875
Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to deserialization of untrusted data in the JobParameterDeserializer. When Jackson2ExecutionContextStringSerializer is used with an untrusted job repository data source, the deserializer...
PT-2026-82395
Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6 Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an...
log4j-4255
log4j2 4255 — FilteredObjectInputStream allowlist bypass vi...
Exploit for CVE-2025-40123
Patch: CVE-2025-40123 Vulnerability Details - CVE: CVE...
Important: dotnet9.0
Issue Overview: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...
Exploit for CVE-2026-69098
CVE-2026-69098 — kotaemon unauthenticated deserialization RCE...
CVE-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
PT-2025-47450
Name of the Vulnerable Software and Affected Versions Apache Causeway affected versions not specified Description Apache Causeway is susceptible to Java deserialization issues that can lead to remote code execution RCE. Exploitation occurs through user-controllable URL parameters. Authenticated...
BIT-PYTORCH-2024-48063
In PyTorch =2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing...
CVE-2024-48063
In PyTorch =2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing...
Linux Distros Unpatched Vulnerability : CVE-2024-48063
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PyTorch =2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed...
PYSEC-2024-259
In PyTorch =2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing...
PT-2024-32976 · Facebook +1 · Pytorch +1
Name of the Vulnerable Software and Affected Versions: PyTorch versions prior to 2.4.1 Description: The issue concerns the RemoteModule in PyTorch, which is reported to have Deserialization RCE. However, it is noted that this behavior is intended in PyTorch distributed computing and is disputed b...