37610 matches found
CVE-2026-47623: Deserialization of Untrusted Data
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering...
Security Bulletin: NVIDIA Dynamo - August 2026
NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...
PT-2026-68506
Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description The Ajax Search Lite – Live Search & Filter plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object...
PT-2026-67805
Name of the Vulnerable Software and Affected Versions NVIDIA Dynamo for Linux affected versions not specified Description An issue exists where an attacker could cause deserialization of untrusted data. Deserialization is the process of converting a data format, such as JSON or XML, back into an...
Important: dotnet10.0
Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...
Important: dotnet8.0
Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...
PT-2026-67744
Name of the Vulnerable Software and Affected Versions kotaemon versions prior to 0.12.1 Description An insecure deserialization issue exists in the 'check connection' endpoint. Unauthenticated attackers can instantiate arbitrary Python classes by providing crafted YAML or JSON input containing a...
Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2009)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2009 advisory. Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits o...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14512, CVE-2026-14528)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Exploit for CVE-2026-56158
CVE-2026-56158 — .NET Framework Remote Code Execution RCE Po...
Exploit for CVE-2026-68771
CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserializatio...
CVE-2026-18642
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
EUVD-2026-52294
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642
CVE-2026-18642 describes a deserialization of untrusted data vulnerability in TÜBİTAK BİLGEM’s eta-otp-lock (affected: before 1.0.4) that may enable Object Injection. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, NO privileges required, but USER INTERACTION is required; confiden...
Joomla Aimy Captcha-Less Form Guard RCE (CVE-2026-65883)
Unauthenticated RCE in Aimy Captcha-Less Form Guard 18.0–20.0: recover the XOR keystream from the clfgd field, inject a FormattedtextLogger gadget, write a PHP webshell, then execute the configured payload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-65883 — Aimy Captcha-Less Form Guard...
MediaWiki CVE-2026-58025 Import Deserialization
Authenticated exploit for CVE-2026-58025: upload a MediaWiki XML export with PHP-serialized via Special:Import. On vulnerable hosts, LogEntryBase::extractParams unserializes without allowedclasses. Use scanner/http/mediawikicve202658025detect for version checks. Requires import/importupload. No...
MediaWiki CVE-2026-58025 Detect
Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...