CVE-2026-43865

camel-hazelcast Default-Instance Unsafe Deserialization Reproducer CVE-2026-43865 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-hazelcast component, tracked as CVE-2026-43865. When Camel builds the Hazelcast Config itself — i.e. when no user-supplied...

Apache Curator 5.9.0 Java Deserialization

Summary Apache Curator is a Java/JVM client library for Apache ZooKeeper, a distributed coordination service. It includes a high level API framework and utilities to make using Apache ZooKeeper much easier and more reliable. It also includes recipes for common use cases and extensions such as...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

PT-2026-107228

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 12.3.2 P4 Description A deserialization issue allows a user with Backup Viewer privileges to execute arbitrary code as SYSTEM on the backup server. Deserialization is the process of converting a dat...

PT-2026-107253

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description An issue exists where an attacker with access to the server secret and Redis write access can submit a malicious serialized cache value. Upon retrieval, the deserialization process can...

PT-2026-107288

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

Next.js 15.5.6 Remote Code Execution

Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...

PT-2026-106707

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

PT-2026-107189

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager versions prior to 6.14.1 Description Deserialization of untrusted data in the web interface allows an unauthenticated remote attacker to execute arbitrary code on the affected system. Deserialization is...

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4

Article Applicability All vulnerabilities listed in this article: Affect only Veeam Backup & Replication 12.3.2 P3 build 12.3.2.4854 and older builds. Are resolved in Veeam Backup & Replication 12.3.2 P4 build 12.3.2.4934. Do not affect any Veeam Backup & Replication version 13 builds. Customers...

Apache Curator 5.9.0 Java Deserialization

Apache Curator version 5.9.0 contains an unsafe Jackson deserialization issue in its service-discovery component that can instantiate an attacker-controlled payload class. https://packetstorm.news/download/234593...

Apache Ratis 3.3.1 Java Deserialization

Apache Ratis versions 3.3.0 and 3.3.1 contain an unsafe Java deserialization vulnerability in RPC reply error handling that can allow remote code execution on a client with a suitable gadget chain. https://packetstorm.news/download/234595...

Apache Commons JCS 3.2.1 Unauthenticated Deserialization

Apache Commons JCS version 3.2.1 contains an unauthenticated Java deserialization vulnerability in its TCP Lateral Cache listener that could allow remote code execution when the lateral cache is enabled. https://packetstorm.news/download/234592...

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.6.2...

CVE-2026-71981

Cypht CVE-2026-71981 PoC This is a PoC for CVE-2026-71981 Insecure deserializaion RCE. Result of executed command is printed in response from logout request after the tags. Use --print-all to also print the whole response. Versions vulnerable: v2.12.2 Install dependencies and execute This script...

EXPLOIT-CVE-2024-7804

CVE-2024-7804 — PyTorch Distributed RPC Unsafe Deserialization RCE Self-contained lab + exploit for CVE-2024-7804 : remote code execution in PyTorch's distributed RPC framework torch.distributed.rpc through unsafe deserialization of untrusted data CWE-502. Affected: torch Note: this advisory was...

CVE-2025-55182-shellinteractive

CVE-2025-55182-shellinteractive Base used from: https://github.com/Emiyelbarto/CVE-2025-55182-PoC Thank you very much for the great contribution. Overview CVE-2025-55182 is a deserialization vulnerability in Next.js/React Server Components that allows unauthenticated remote attackers to execute...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...