37441 matches found
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
DEBIAN-CVE-2026-63639
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
AZL-96885 CVE-2026-63639 affecting package valkey for versions less than 8.0.10-1
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-63639
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
EUVD-2026-60942
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
CVE-2026-59940
In seroval (npm package) versions prior to 1.5.3, fromJSON() suffered a type confusion flaw where attacker-controlled Promise control nodes could operate on values in the general deserialization reference table without verifying they were genuine internal promise resolver records. This caused des...
CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
CVE-2026-59940 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
CVE-2026-63639
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-63639
Valkey (distributed key-value DB) has a use-after-free in the RESTORE command's RDB stream consumer-group deserialization: a malformed payload assigns one Pending Entry List NACK to multiple consumers, and deleting one while another references it can lead to remote code execution (CVSS 8.8 HIGH, ...
CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20
CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20. A patched version of the package is available...
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73397
Youzify plugin versions up to 1.3.7 suffer from unauthenticated deserialization of untrusted data, scored CVSS 9.8 (critical) with network access, no privileges, and full CIA impact. Upgrade beyond 1.3.7 or disable the plugin; no exploit code is provided in the documents.