Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

CVE-2025-55182-RCE-Exploit

POC para CVE-2025-55182 – Ejecución Remota de Código en Next.js 16.0.6 Este repositorio contiene un proof-of-concept POC funcional para CVE-2025-55182 , una vulnerabilidad crítica de deserialización que afecta a Next.js 16.0.6. El exploit abusa de la deserialización de chunks $@ y de...

CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit

CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...

REACT-CVE-2025-55182-Lab

React-2025 CTF Lab: CVE-2025-55182 Overview This repository contains a Capture The Flag CTF lab designed strictly for educational use and security research. The environment features a vulnerable Next.js 16 e-commerce mock storefront "Quantum Supplies" specifically built to demonstrate and practic...

Exploit for Deserialization of Untrusted Data in Facebook React

Penetration Testing Writeup: Next.js RCE & Node.js Inspector Pri...

CVE-2021-30128-EXP

CVE-2021-30128 Apache OFBiz EXP de vulnerabilidad de deserialización Referencia https://mp.weixin.qq.com/s/Dr-jwiRr4NByjErjiXe1w...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...

CVE-2026-61775

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61778

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61772

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69330

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61761

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61752

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) ...

CVE-2026-61754

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-69304

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84328

Name of the Vulnerable Software and Affected Versions NVIDIA Megatron Bridge affected versions not specified Description An issue exists where an attacker could cause a deserialization of untrusted data. Deserialization is the process of converting a data format back into an object. A successful...

PT-2026-84333

Name of the Vulnerable Software and Affected Versions NVIDIA Megatron Bridge affected versions not specified Description An issue exists where an attacker could cause a deserialization of untrusted data. Deserialization is the process of converting a data format back into an object. A successful...