CVE-2022-23884

CVE-2022-23884 There is a network-layer vulnerabilities in the official server of Minecraft: Bedrock Edition aka Bedrock Server,which allow attacker to launch a DoS attack. CVE-2022-23884 Mojang Bedrock Dedicated Server 1.16.0-1.18.12 is affected by an large loop and crash server caused by...

react-rsc-cve-2025-55182-lab

CVE-2025-55182 Lab — React Server Components RCE Educational lab demonstrating CVE-2025-55182 — a critical CVSS 10.0 Remote Code Execution vulnerability in React Server Components caused by prototype pollution in the Flight protocol deserializer. Disclaimer: This repository is for educational and...

Deserializer

Deserializer About the Project Deserializer is an advanced Abstract Syntax Tree AST static analysis engine designed to identify insecure object reconstruction and state persistence sinks across the Python ecosystem, with strong focus on AI, LLM, Robotics, Data Science, Machine Learning and Deep...

CLEANSTART-2026-DM34399 jackson-databind's deserializer for java

Security vulnerability affects the strimzi-kafka-operator package. jackson-databind's deserializer for java...

CLEANSTART-2026-HS93465 jackson-databind's deserializer for java

Security vulnerability affects the gradle package. jackson-databind's deserializer for java...

CLEANSTART-2026-WD15380 jackson-databind's deserializer for java

Security vulnerability affects the spark-sc213-jdk17-py312 package. jackson-databind's deserializer for java...

CLEANSTART-2026-EL20329 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-HN59965 jackson-databind's deserializer for java

Security vulnerability affects the sonarqube package. jackson-databind's deserializer for java...

CLEANSTART-2026-FJ26239 jackson-databind's deserializer for java

Security vulnerability affects the sonarqube package. jackson-databind's deserializer for java...

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

Amazon Linux 2 : amazon-efs-utils (ALAS-2026-4044)

The version of amazon-efs-utils installed on the remote host is prior to 3.1.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4044 advisory. Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface...

Important: amazon-efs-utils

Issue Overview: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted b...

CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116581

The Seroval library (prior to version 1.6.8 ) is vulnerable to an unauthenticated Denial of Service (DoS) via the fromJSON and fromCrossJSON deserializers. The root cause is a lack of validation for a sequence node's done index; a crafted index can create an iterator that never finishes, causing ...

CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-19032)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-19032 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-3333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3333 advisory. Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations...

php2shell-pcaps

PHP2Shell PCAPs Packet captures from the php2shell vulnerabil...

Important: amazon-efs-utils

Issue Overview: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted b...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...