WordPress plugin Advanced AJAX Product Filters 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Bosch Rexroth IndraWorks 安全漏洞

Bosch Rexroth IndraWorks is a general engineering framework software developed by the German company Bosch Rexroth. Bosch Rexroth IndraWorks has a security vulnerability that stems from deserialization issues when parsing specially crafted files containing malicious serialized data, which may lea...

Bosch Rexroth IndraWorks 安全漏洞

Bosch Rexroth IndraWorks is a general engineering framework software developed by the German company Bosch Rexroth. Bosch Rexroth IndraWorks has a security vulnerability that stems from deserialization issues when parsing specially crafted files containing malicious serialized data, which may lea...

PT-2026-20414

A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which...

OSEC-2026-01 Buffer Over-Read in OCaml Marshal Deserialization

Summary A critical buffer over-read vulnerability in OCaml's Marshal deserialization runtime/intern.c enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock function, which performs unbounded memcpy operations usin...

CVE-2026-2555

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

CVE-2026-2555

CVE-2026-2555 affects JeecgBoot 3.9.1 in the Retrieval-Augmented Generation component, specifically the importDocumentFromZip function in AiragKnowledgeController.java. The issue is a deserialization vulnerability triggered by manipulating input, allowing a remote attacker to exploit the flaw. Th...

CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization

A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization...

JeecgBoot 代码问题漏洞

JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. Version 3.9.1 of JeecgBoot contains a code vulnerability. This vulnerability stems from a deserialization issue in the importDocumentFromZip function of the component in the file...

CVE-2026-26215

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

SUSE SLES15 / openSUSE 15 Security Update : python-azure-core (SUSE-SU-2026:0476-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0476-1 advisory. - CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a networ...

Deserialization of Untrusted Data

Overview cesargb/laravel-magiclink is a Create secure link for access to private data or login in Laravel without password Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the magiclinks.action database column during the deserialization process. An attacke...

Security update for python-azure-core

This update for python-azure-core fixes the following issues: CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. bsc1257703 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:0476-1 Security update for python-azure-core

This update for python-azure-core fixes the following issues: - CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. bsc1257703...

Exploit for Deserialization of Untrusted Data in Facebook React

This Proof of Concept PoC for React2Shell CVE-2025-55182 vul...

PT-2026-7948

Name of the Vulnerable Software and Affected Versions GFI Archiver affected versions not specified Description A flaw exists in GFI Archiver related to the deserialization of untrusted data within the MArc.Core component. This allows remote attackers to potentially execute arbitrary code on...

DiskCache has unsafe pickle deserialization

DiskCache python-diskcache through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache...

Deserialization of Untrusted Data

Overview diskcache is a Disk Cache -- Disk and file backed persistent cache. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the unsafe use of the pickle.load function in the Cache class. An attacker can execute arbitrary code by writing malicious data...

CVE-2026-0910 wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforodisplayarraydata' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...