CVE-2026-19363

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw...

CVE-2026-19363

CVE-2026-19363 affects the lmammino oidc-authorizer package up to version 0.4.0. The flaw resides in the unwrap function of src/handler.rs in the Fixed Message Handler, where manipulating the jwtClaims argument enables deserialization and remote execution. Public exploitation is noted, and the ve...

EUVD-2026-54934

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is the function unwrap of the file src/handler.rs of the component Fixed Message Handler. The manipulation of the argument jwtClaims results in deserialization. The attack can be executed remotely. The exploit has been ma...

CVE-2026-66713

A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3155)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-3101)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in...

EUVD-2026-54568

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182---Advanced-React-Server-Components-RCE-Exploit...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71559

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

CVE-2026-71560

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-31221

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization CWE-502, exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.loadfromcheckpoi...

EUVD-2026-54423

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users o...

EUVD-2026-54422

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558

CVE-2026-71558 describes a heap type confusion in Apache Fory C++ during polymorphic smart-pointer deserialization. A crafted input can bypass type compatibility checks, causing an object of an incompatible type to be treated as the declared base type, potentially leading to undefined behavior an...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558 Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

EUVD-2026-54421

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-71560 Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-71560

CVE-2026-71560 describes an out-of-bounds heap read in the C++ deserializer of Apache Fory when deserializing structs containing tagged integer fields. Affected: Apache Fory C++ versions 0.14.0 up to, but not including, 1.5.0. Impact: potential information disclosure or denial of service via a cr...