EUVD-2026-104470

IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java...

CVE-2026-12148

The IBM MQ product is vulnerable to a high-severity security issue where an authenticated attacker could cause a denial of service or potentially execute arbitrary code . The root cause is unrestricted Java deserialization within the MQ Classes for Java . The impact includes high levels of confid...

CVE-2024-5452

CVE-2024-5452 01. Overview of RCE and pytorch-lightning 1 Overview of RCE and pytorch-lightning RCE Remote Code Execution is a vulnerability that allows an attacker to execute arbitrary code remotely within a system or application, and is classified as CWE-94: Improper Control of Generation of...

CVE-2025-24813-noPoC

CVE-2025-24813-noPoC After countless hours I was unable to come up with any real PoC. While the deserialization of uploaded files could pose a threat, all payload-chains I tested failed. Tested on versions 9.0.90 and 10.1.15 of Apache Tomcat Nothing else to see here! SEVERE http-nio-8080-exec-5...

CVE-2025-64512---pdfminer.six-Remote-Code-Execution-RCE-

CVE-2025-64512 - pdfminer.six Remote Code Execution RCE -orange WARNING – EDUCATIONAL USE ONLY This proof-of-concept is for authorized security testing and educational purposes only. Use only on systems you own or have explicit written permission to test. The author is not responsible for any...

CVE-2026-112304

docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading...

react2shell-poc

React2Shell - CVE-2025-55182 PoC Proof of Concept for CVE-2025-55182 , a critical unauthenticated Remote Code Execution vulnerability in React Server Components. CVSS Score: 10.0 Critical Vulnerability The vulnerability exists in React's Flight protocol deserializer. By exploiting prototype...

comfyui-CVE-2026-68771-PoC

CVE-2026-68771 — ComfyUI: Unauthenticated RCE via Insecure Deserialization For educational purposes only. Only use against systems you own or have explicit written authorization to test. About ComfyUI ComfyUI is an open-source node-based graphical interface for running AI image and video generati...

HttpRemotingObjRefLeak

Leaking and Exploiting ObjRefs via HTTP .NET Remoting CVE-2024-29059 This repository provides further details and resources on the CODE WHITE blog post of the same name Leaking ObjRefs to Exploit HTTP .NET Remoting: 1. Creating a vulnerable ASP.NET web application 2. Detecting ObjRef leaks 3...

CVE-2025-55182

CVE-2025-55182 - React & Next.js Server Actions RCE Exploit Full-featured Remote Code Execution exploit and scanner for CVE-2025-55182 in React/Next.js Server Actions. Original PoC: Spritualkb/CVE-2025-55182-exp Overview CVE-2025-55182 is a critical prototype pollution vulnerability in React Serv...

CVE-2026-112304 docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()

docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading...

EUVD-2026-104396

docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading...

CVE-2026-112304

The docTR library (versions through 1.1.0 ) is vulnerable to Remote Code Execution (RCE) via unsafe deserialization in the load_pretrained_params() function. The root cause is the use of torch.load without setting weights_only=True, which allows attackers to execute arbitrary Python code by provi...

CVE-2026-112304 docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()

docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading...

CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization CVE-2025-49113 🔍 Writeup A critical post-authentication Remote Code Execution vulnerability was discovered in Roundcube versions ≤ 1.6.10, caused by insecure PHP object deserialization. This severe flaw has silently persisted in th...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, wi...

CVE-2026-59827

CVE-2026-59827 — Unsafe Deserialization of H2 Query Results in Metabase GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critical | CWE-502: Deserialization of Untrusted Data Overview CVE-2026-59827 is a critical remote code execution vulnerability in Metabase, the popular open-source business intelligence and dat...

CVE-2021-41078

CVE-2021-41078 nameko Arbitrary code execution due to YAML deserialization NVD Description Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. Demo Set Up 1. Build an image from a Dockerfile docker build -t cve-2021-41078 . 2. Run pyth...

MassExploit-CVE-2025-55182

CVE-2025-55182 – Massive Scanner PoC CVE-2025-55182 also referred to as “React2Shell” is a critical Remote Code Execution RCE vulnerability in the React Server Components RSC system. The issue occurs because the HTTP payload deserialization mechanism for “Server Functions” processes untrusted inp...

ActiveMQ-EXPtools

ActiveMQ-EXPtools Supports detecting and exploiting Apache ActiveMQ vulnerabilities: CVE-2015-5254, CVE-2016-3088, CVE-2022-41678, CVE-2023-46604, CVE-2024-32114, CVE-2026-34197, CVE-2026-40466, CVE-2026-42588 !WARNING This tool is intended for security research and learning purposes only. Users...