CVE-2026-17572

CVE-2026-17572 : In HDF5 (vulnerable through 2.1.1), the SOHM list-index deserialization code is vulnerable to a heap-based buffer overflow. A crafted HDF5 file whose shared-message list index declares a num_messages greater than list_max can trigger out-of-bounds heap reads/writes in H5SM__cache...

CVE-2026-17572

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

Remote Code Execution

fastjson is vulnerable to remote code execution RCE. The vulnerability is due to insecure deserialization in Fastjson, where specially crafted input can trigger arbitrary code execution under the default configuration without requiring AutoType to be enabled or any classpath gadget...

Exploit for Deserialization of Untrusted Data in Facebook React

Tìm hiểu về React Server Components và giao thức Flight REac...

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-hateoas jar (CVE-2026-41006, CVE-2026-41007)

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41006 and CVE-2026-41007 reported for spring-hateoas-2.4.1.jar, spring-hateoas-2.5.2.jar . Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromPropertie...

BIT-DOTNET-2026-50649 .NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

BIT-DOTNET-SDK-2026-50649 .NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

ElasticSearch - Remote Code Execution

ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine. id: CVE-2015-1427 info: name: ElasticSearch - Remote Code Execution author: pikpikcu...

Fortra GoAnywhere MFT - Remote Code Execution

Fortra GoAnywhere MFT is susceptible to remote code execution via unsafe deserialization of an arbitrary attacker-controlled object. This stems from a pre-authentication command injection vulnerability in the License Response Servlet. id: CVE-2023-0669 info: name: Fortra GoAnywhere MFT - Remote...

PT-2026-64975

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a num messages count exceeding list max, triggering out-of-bounds heap...

Telerik UI for ASP.NET AJAX < 2026.2.708 Multiple Vulnerabilities

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout...

PT-2026-65107

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description A deserialization weakness exists in the way JFrog Artifactory handles packages. This flaw could allow a low-privileged user to compromise confidentiality, integrity, and availabili...

PT-2026-65013

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

PT-2026-65029

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 Proof-of-Concept Lab An isolated...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...