EUVD-2026-73785

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-77484

CVE-2026-77484 is a remote code execution vulnerability in Microsoft SQL Server caused by deserialization of untrusted data , allowing an authorized attacker to execute code over a network. The CVSS v3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-explo...

CVE-2026-65772

CVE-2026-65772 is a deserialization of untrusted data flaw in Microsoft Dynamics 365 On-Premises that allows an authorized attacker (low privileges) to execute code over a network. The CVSS 3.1 score is 8.8 (High) with high impact to confidentiality, integrity, and availability, and no user inter...

EUVD-2026-73738

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

CVE-2026-47297

Microsoft SQL Server is affected by a deserialization of untrusted data vulnerability that allows an unauthorized attacker to achieve remote code execution over a network . The vulnerability requires no prior authentication or user interaction but carries a High attack complexity , resulting in a...

EUVD-2026-73644

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-73043

Deserialization of untrusted data in Windows IP Address Management IPAM Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69694

CVE-2026-69694 affects the Windows IP Address Management (IPAM) Service . The root cause is deserialization of untrusted data , which allows an authorized attacker to escalate privileges locally. The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating tha...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

GHSA-X99W-6FGC-PMFW NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

EUVD-2026-65229

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution...

GHSA-RHP5-R9X4-F5G2 NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...

CVE-2026-12745

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

CVE-2026-12744

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server...

CVE-2026-12650

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12651

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12648

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

Deserialization Of Untrusted Data

Spring for Apache Kafka is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper trusting java.net packages by default, which allows an external Kafka producer to inject malicious java.net.InetAddress types through the...