Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent

Summary Vulnerabilities in IBM SDK Java Technology Edition that is shipped as part of agent framework in ITCAM for Applications WebSphere MQ Monitoring Agent. CVEs: CVE-2026-41254, CVE-2026-47057, CVE-2026-47058, CVE-2026-47063 and CVE-2026-8400 Vulnerability Details CVEID:CVE-2026-47057...

MINI-H498-GRPW-2M86

Bulletin has no description...

MINI-3CM3-CP96-CFMX

Bulletin has no description...

CVE-2026-65609 Out-of-bounds write in nnn

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

EUVD-2026-62398

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-73389

CVE-2026-73389 is an unauthenticated PHP Object Injection vulnerability in the Kalles Addons WordPress plugin, affecting versions 1.0.6 and earlier . The flaw allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability, reflected in a CVSS ...

CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 – Apache ActiveMQ Remote Code Execution Ove...

Exploit for Deserialization of Untrusted Data in Citrix Session_Recording

cve-id Donate Support the maintenance of this project wit...

CVE-2026-75987

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987 SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987 SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987 SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987

SPLWare esProc up to 20260507 deserializes untrusted network input via ObjectInputStream.readUnshared in SocketData.java, enabling remote unauthenticated code execution (CVSS 7.5 HIGH). No fix or exploit details are provided. No in-the-wild exploitation reported.

EUVD-2026-62221

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

PT-2026-79871

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

PT-2026-78540

Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0402 Description An insecure deserialization issue allows a remote attacker to obtain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to...

PT-2026-78822

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description A user with the "power" Splunk role can execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. This occurs because a model codec...

PT-2026-78831

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.2.1 Description Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management componen...

CVE-2026-49816: Deserialization of Untrusted Data

Dell Command Update DCU, versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...