37366 matches found
Panic on Decoding Short Hybrid Keys
The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...
CVE-2025-53770-Scanner
🛡️ Scanner de Vulnerabilidade CVE-2025-53770 no SharePoint Uma ferramenta baseada em Python para detectar instâncias vulneráveis do Microsoft SharePoint afetadas por CVE-2025-53770 , uma vulnerabilidade de desserialização insegura acionada através do endpoint ToolPane.aspx. O scanner envia um...
Exploit for Integer Overflow or Wraparound in Google Android
CVE-2025-48595 — Android Framework Integer Overflow Vulnerabil...
Exploit for Deserialization of Untrusted Data in Facebook React
Next.js React Server Components RCE Exploit Exploits CVE-2025...
dotnet: .NET: Local code execution via deserialization of untrusted data
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of...
dotnet: .NET: Local code execution via deserialization of untrusted data
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of...
BIT-VALKEY-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
dotnet: .NET: Local code execution via deserialization of untrusted data
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of...
Exploit for CVE-2025-40123
Patch: CVE-2025-40123 Vulnerability Details - CVE: CVE...
dotnet: .NET: Local code execution via deserialization of untrusted data
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of...
dotnet: .NET: Local code execution via deserialization of untrusted data
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to execute code locally by exploiting a deserialization of untrusted data. This means that if an attacker can provide specially crafted data, the .NET application may process it in a way that leads to the execution of...
EUVD-2026-64671
A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/opparams results in deserialization. The attack may be...
PT-2026-81010
Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.18.9 jackson-databind versions prior to 2.21.5 jackson-databind versions prior to 2.22.1 jackson-databind versions prior to 3.1.5 jackson-databind versions prior to 3.2.1 Description The java.net.InetAddres...
CVE-2026-76843: Deserialization of Untrusted Data
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-78262: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...
CVE-2026-32563: Deserialization of Untrusted Data
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
PT-2026-80853
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodel file and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-78265: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
PT-2026-107471
The deserialization functions X25519MlKem768Draft00PrivateKey::decode X25519MlKem768Draft00PublicKey::decode and XWingKemDraft06PublicKey::decode would panic during an indexing operation when provided an input slice that is shorter than the length of the given key type, i.e. shorter than 2400 byt...
PT-2026-80002
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...