29212 matches found
Security Updates for Microsoft SharePoint Server 2016 (July 2026)
The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. CVE-2026-505...
PT-2026-60864
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description A remote code execution issue exists in the disk-based caching mechanism. The AsyncDiskCache class uses the unsafe pickle.loads function to deserialize cached objects from disk without...
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in their deserialization mechanism flaws, which allows attackers to execute arbitrary code.
The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Security Updates for Microsoft SharePoint Server Subscription Edition (July 2026)
The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a...
Exploit for Deserialization of Untrusted Data in Facebook React
CVE-2025-55182 Unsafe Deserialization - RCE React 19.0.0...
GHSA-5RG2-XV9J-GV5P nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted TrieChunk whose proof contains a TrieNodeChild whose suffix, when concatenated with the parent key via KeyNibbles::Add, exceeds the fixed 63-byte backing array. Add primitives/src/keynibbles.rs:332 / :34...
CVE-2026-14890
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when...
Security Bulletin: Multiple Vulnerabilities in IBM Datacap
Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.10 released on December 19, 2025 and IBM Datacap version 9.1.9 Interim Fix 008 released on June 15, 2026 Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: JMSSink in all versions of Log4j 1.x is vulnerable to...
CVE-2026-14890
SGLang is vulnerable to unauthenticated remote code execution via its expert-parallel backup subsystem. The issue centers on a ZeroMQ PULL socket exposed on a routable network interface with no authentication or deserialization safeguards, allowing an attacker to send a malicious pickle payload t...
Exploit for Deserialization of Untrusted Data in Facebook React
Next.js RSC RCE Exploit Tool CVE-2025-55182 !https://soc...
SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem
Overview A Pickle deserialization vulnerability has been discovered within the SGLang project, enabling an attacker to perform remote code execution RCE on the target vulnerable server. In order for an attacker to exploit this vulnerability, the expert-parallel backup subsystem must be enabled, a...
PT-2026-61613
Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.5 Description Issues in the Cluster Distributed API DAPI handling allow a cluster peer or any actor authenticated to the cluster channel using the shared cluster key to force the master node to deserialize and...
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network...
GHSA-R3HX-X5RH-P9VV django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization
Remote Code Execution via eval in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls eval on raw field values returned from Elasticsearch when a SearchField is declared with an indexfieldname alias that differs from the logical field name. During resul...
actix-prost (>=0.1.0, <=0.3.2), adns-server (>=0.1.0, <=0.3.0) +759 more potentially affected by unknown CVE via serde_with (>=3.8.1, <=3.14.1)
serdewith CARGO version =3.8.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =0.1.1, =0.1.1, =0.1.5, =0.1.0, =0.1.0, =0.10.1 - attest-prove 0.0.1 - attest-types 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7GCF-G7XR-8HXJ...
Vulnerability of .NET and Microsoft Visual Studio software platforms, related to deserialization mechanism flaws, allows attackers to execute arbitrary code.
The vulnerability of .NET and Microsoft Visual Studio software platforms is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
The vulnerability of the extractBodyFromJms() function in the camel-jms Java framework by Apache Camel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the extractBodyFromJms function in the camel-jms Java framework by Apache Camel is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.1 Vulnerability Details CVEID:CVE-2026-42342 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certai...
Incorrect Authorization
Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling properties annotated with both @JsonView and @JsonUnwrapped. An attacker can modify data that should be restricted to a higher-privileged view by supplying crafted JSO...