36764 matches found
CVE-2026-102567 CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-101169
Affected versions of Octopus Server are vulnerable to insecure deserialization of specifically crafted JSON content. An authenticated user with permissions to edit an Environment or Project can exploit this flaw to execute arbitrary code within the Octopus Server process. No specific patch versio...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
EUVD-2026-88654
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CLEANSTART-2026-KA44549 jackson-databind's deserializer for java
CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...
CLEANSTART-2026-YH31321 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
CLEANSTART-2026-ET86830 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
PT-2026-102945
Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An issue exists in the SAML single sign-on session handling samld where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the...
PT-2026-102935
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description The router profiler service contains a flaw that allows remote code execution when the application is started with the --enable profiling flag. The service exposes an unauthenticated RPyC server wit...
PT-2026-102633
Name of the Vulnerable Software and Affected Versions Amazon GluonTS versions prior to 0.17.0 Description Deserialization of untrusted data in the model loading component allows context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process b...
CVE-2026-101169: Deserialization of Untrusted Data
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-103041: Deserialization of Untrusted Data
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...
PT-2026-102936
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache...
PT-2026-102457
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...
CVE-2026-100308: Deserialization of Untrusted Data
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...
PT-2026-102787
Name of the Vulnerable Software and Affected Versions MobilityDB versions prior to 1.3.1 Description An out-of-bounds read exists in the MEOS binary and library WKB deserialization logic. Unprivileged database users can cause a remote denial-of-service condition, crashing the PostgreSQL backend...
CVE-2026-103040: Deserialization of Untrusted Data
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...