CVE-2026-18163 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data...

CVE-2026-18163 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data...

CVE-2026-17637

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by multiple vulnerabilities, including one that allows an adjacent-network attacker to execute arbitrary code . This flaw stems from the deserialization of untrusted data . The CVSS 3.1 score is 8.8 (High), indicating high i...

CVE-2026-17637 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2026-17637 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

EUVD-2026-84866

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615

The openEQUELLA software prior to version 2026.1.0 is vulnerable to authenticated remote code execution (RCE) via Java deserialization in the HTTP invoker endpoint at /invoker/*. An authenticated non-guest user can bypass the PluginAwareObjectInputStream class-name denylist by nesting a serialize...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-28325

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

UBUNTU-CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

Security Bulletin: Vulnerabilities in WebSphere Liberty profile(CVE-2026-14525, CVE-2026-16192, CVE-2026-10571, CVE-2026-14976, CVE-2026-15280, CVE-2026-18499, CVE-2026-14980, CVE-2026-2482, CVE-2026-14529, CVE-2026-10841) affect Power PowerVM Novalink

Summary The WebSphere Liberty profile used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure...

EUVD-2026-84678

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-28325 SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-28325

SolarWinds Observability Self-Hosted is impacted by an unauthenticated remote code execution vulnerability. This flaw originates from the deserialization of untrusted data when the application is configured to use a specific communication mode. The vulnerability allows for high impact on confiden...

CVE-2026-28325 SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-83803

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...