36580 matches found
CLEANSTART-2026-NU36119 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
CLEANSTART-2026-GG17411 Deserialization of untrusted data vulnerability in QOS
Security vulnerability affects the sonarqube package. Deserialization of untrusted data vulnerability in QOS...
CLEANSTART-2026-CF09659 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)
Security vulnerability affects the sonarqube package. Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586...
CVE-2026-43865
camel-hazelcast Reproductor de Deserialización Insegura de Instancia Predeterminada CVE-2026-43865 Este proyecto demuestra una vulnerabilidad de deserialización de Java en el componente camel-hazelcast de Apache Camel, rastreada como CVE-2026-43865. Cuando Camel construye la Config de Hazelcast p...
Apache Curator 5.9.0 Java Deserialization
Summary Apache Curator is a Java/JVM client library for Apache ZooKeeper, a distributed coordination service. It includes a high level API framework and utilities to make using Apache ZooKeeper much easier and more reliable. It also includes recipes for common use cases and extensions such as...
Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization
Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...
PT-2026-107228
Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 12.3.2 P4 Description A deserialization issue allows a user with Backup Viewer privileges to execute arbitrary code as SYSTEM on the backup server. Deserialization is the process of converting a dat...
PT-2026-107253
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description An issue exists where an attacker with access to the server secret and Redis write access can submit a malicious serialized cache value. Upon retrieval, the deserialization process can...
PT-2026-107288
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...
Next.js 15.5.6 Remote Code Execution
Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...
PT-2026-106707
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...
PT-2026-107189
Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager versions prior to 6.14.1 Description Deserialization of untrusted data in the web interface allows an unauthenticated remote attacker to execute arbitrary code on the affected system. Deserialization is...
Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4
Article Applicability All vulnerabilities listed in this article: Affect only Veeam Backup & Replication 12.3.2 P3 build 12.3.2.4854 and older builds. Are resolved in Veeam Backup & Replication 12.3.2 P4 build 12.3.2.4934. Do not affect any Veeam Backup & Replication version 13 builds. Customers...
Apache Curator 5.9.0 Java Deserialization
Apache Curator version 5.9.0 contains an unsafe Jackson deserialization issue in its service-discovery component that can instantiate an attacker-controlled payload class. https://packetstorm.news/download/234593...
Apache Commons JCS 3.2.1 Unauthenticated Deserialization
Apache Commons JCS version 3.2.1 contains an unauthenticated Java deserialization vulnerability in its TCP Lateral Cache listener that could allow remote code execution when the lateral cache is enabled. https://packetstorm.news/download/234592...
Apache Ratis 3.3.1 Java Deserialization
Apache Ratis versions 3.3.0 and 3.3.1 contain an unsafe Java deserialization vulnerability in RPC reply error handling that can allow remote code execution on a client with a suitable gadget chain. https://packetstorm.news/download/234595...
NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.6.2...
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...
GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...
CVE-2026-71981
PoC de Cypht CVE-2026-71981 Este es un PoC para CVE-2026-71981, una RCE por deserialización insegura. El resultado del comando ejecutado se imprime en la respuesta de la solicitud de cierre de sesión después de las etiquetas . Use --print-all para imprimir también la respuesta completa. Versiones...