CVE-2026-54071: Deserialization of Untrusted Data

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

Microsoft Entra ID Deserialization of Untrusted Data Vulnerability

Microsoft Entra ID formerly known as Azure Active Directory contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network...

CVE-2026-77646

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77645

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-69836

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-77646 Server Side Request Forgery (SSRF) vulnerability reported in Windchill

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77646 Server Side Request Forgery (SSRF) vulnerability reported in Windchill

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77646

A Server-Side Request Forgery (SSRF) vulnerability affects PTC Windchill PDMLink and PTC FlexPLM , exploitable through the deserialization of untrusted data . An unauthenticated remote attacker can trigger the flaw over the network with no user interaction, resulting in high confidentiality impac...

CVE-2026-77645

CVE-2026-77645 is a critical remote code execution (RCE) vulnerability in PTC Windchill and PTC FlexPLM , caused by deserialization of untrusted data . The CVSS 4.0 base score is 9.2 (CRITICAL) , with a network attack vector requiring no privileges and no user interaction . CISA's SSVC assessment...

CVE-2026-77645 Critical Remote Code Execution (RCE) vulnerability reported in Windchill

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-77645 Critical Remote Code Execution (RCE) vulnerability reported in Windchill

A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

CVE-2026-69836

CVE-2026-69836 is a CVSS 10.0 (Critical) deserialization of untrusted data vulnerability in Microsoft Entra ID (formerly Azure Active Directory), enabling an unauthorized attacker to achieve remote code execution over a network with no privileges or user interaction required. The vulnerability wa...

CVE-2026-18285

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-15679

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...

CVE-2026-15679

The vulnerability is in timm's checkpoint parsing code, which deserializes untrusted PyTorch checkpoint data without validation, enabling arbitrary code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). No affected ve...

EUVD-2026-63459

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...

CVE-2026-15679 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...

CVE-2026-15679 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this...

CVE-2026-18285 Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-18285 Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

Aeon loadrehabpiledataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a...