CVE-2026-81867

A Deserialization of Untrusted Data vulnerability exists in the JavaScript Task of Google Cloud Application Integration (versions prior to 2026-06-28). An authenticated user with standard permissions can execute arbitrary code on shared production servers by using a specially crafted script that ...

Exploit for CVE-2026-82384

CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization...

Unsafe Polymorphic Deserialization

jackson-databind is vulnerable to unsafe polymorphic deserialization. The vulnerability is due to DefaultBaseTypeLimitingValidator allowing essentially any class implementing Comparable, which allows an attacker to provide a crafted type identifier and instantiate attacker-chosen objects such as...

CVE-2026-82384

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

EUVD-2026-88137

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384

Apache Roller 6.1.5 is vulnerable to an unauthenticated remote code execution (RCE) flaw due to the deserialization of untrusted data (CWE-502). The XmlRpcServlet accepts vendor extension types (e.g., ex:serializable) which are deserialized during request parsing before any authentication occurs....

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION:...

Uncontrolled Resource Consumption

jackson-databind is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the deserialization of arbitrarily long numeric components in XML datatype strings without length validation, which allows an unauthenticated attacker to submit specially crafted JSON values that caus...

CVE-2026-84650

A flaw was found in Jenkins. Attackers capable of submitting configuration updates can exploit a deserialization vulnerability by specifying values for transient fields. Although these fields are normally excluded from serialization, they are still processed during deserialization, which can lead...

CVE-2026-84645

A flaw was found in Jenkins. This vulnerability allows a remote attacker to achieve remote code execution. By manipulating user-submitted configuration files, an attacker can exploit a deserialization weakness where specially crafted objects can process HTTP requests. This grants unauthorized...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

CVE-2026-87741: Improper Neutralization of Special Elements used in an OS Command

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cpdisplaypreviewmodal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset check and fails...

CVE-2026-81867: Deserialization of Untrusted Data

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially...

PT-2026-99851

Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-06-28 Description A Deserialization of Untrusted Data issue in the JavaScript Task on Google Cloud Platform allows an authenticated user with standard permissions to execute arbitrary...

The vulnerability of Microsoft Publisher software, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Publisher software, Microsoft Office packages, and Microsoft 365 Apps for Enterprise is related to deserialization mechanism flaws. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-102356

Name of the Vulnerable Software and Affected Versions ConvertPlus versions prior to 3.6.4 Description The plugin is susceptible to deserialization of untrusted data through the style parameter of the cp display preview modal AJAX action. The issue occurs because the nonce guard is bypassed when t...