37600 matches found
PT-2026-76467
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from config method. This method invokes torch.load..., weights only=False without requiring an explicit unsafe opt-in, suc...
CVE-2026-12480 affecting package keras for versions less than 3.3.3-8
CVE-2026-12480 affecting package keras for versions less than 3.3.3-8. A patched version of the package is available...
CVE-2026-19363
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...
EEF-CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...
CVE-2026-69659
CVE-2026-69659 affects ash-project Ash, specifically the keyset pagination cursor handling in Ash.Page.Keyset. Read actions using keyset pagination deserialize client-supplied page[:after] or page[:before] by base64 decoding the cursor and passing it to Erlang :erlang.binary_to_term/2 without siz...
CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...
CVE-2026-19363 lmammino oidc-authorizer Lambda Authorizer handler.rs log file
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...
CVE-2026-19363
CVE-2026-19363 affects the lmammino oidc-authorizer package up to version 0.4.0. The flaw resides in the unwrap function of src/handler.rs in the Fixed Message Handler, where manipulating the jwtClaims argument enables deserialization and remote execution. Public exploitation is noted, and the ve...
CVE-2026-19363
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...
EUVD-2026-54934
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been ma...
CVE-2026-69659: Deserialization of Untrusted Data
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...
CVE-2026-66713
A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...
Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā...
CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity
teamcity-CVE-2026-63077-pcap teamcity teamcity-CVE-2026-63077...
EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3155)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
CVE-2026-16267: Deserialization of Untrusted Data
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects...
EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3101)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...
PT-2026-69168
Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16 Description An issue exists where the software fails to restrict the classes allowed during the unserialization of values received from public form submissions. This allows unauthenticated...
About Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) vulnerability
About Remote Code Execution - Microsoft SharePoint CVE-2026-58644 vulnerability. Information about this vulnerability was published on July 14 as part of the July Microsoft Patch Tuesday. The vulnerability in Microsoft SharePoint Server, caused by a deserialization flaw CWE-502, allows an attacke...