CVE-2020-35728

Beschreibung FasterXML jackson-databind 2.x vor 2.9.10.8 behandelt die Interaktion zwischen Serialisierungs-Gadgets und Typisierung fehlerhaft, was mit com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool auch bekannt als eingebettetes Xalan in org.glassfish.web/javax.servlet.jsp.jst...

CVE-2025-53691

CVE-2025-53691: Esecuzione di codice in remoto RCE tramite deserializzazione insicura Lo stesso meccanismo di reflection in AjaxScriptManager può essere utilizzato per invocare il metodo ProcessSerializedData. Questo metodo deserializza un payload fornito utilizzando l'insicuro BinaryFormatter,...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095 Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize function when transferring multi-value data for the SOLRCLASSIFICATION, SOLRMULTIVALUE and SOLRRELATION content object types, rather than a safe format. If user-generated content saved ...

CVE-2026-56095

The Apache Solr for TYPO3 – Enterprise Search (solr) extension is affected by an insecure deserialization flaw in its indexer. When transferring multi-value data for the SOLR_CLASSIFICATION , SOLR_MULTIVALUE , and SOLR_RELATION content object types, every field value returned by content object re...

TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...

react2shell-burp

Scanner e Validador React2Shell RCE CVE-2025-55182 Criador: j0lt Colaborador: https://github.com/shashank18 Uma extensão do Burp Suite que detecta e valida a vulnerabilidade React2Shell CVE-2025-55182 — uma falha de execução remota de código sem autenticação em React Server Components. A extensão...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Typ: Live-Produktion Incident Response Schwachstelle: CVE-2025-55182 — React Server Components Unsichere Deserialisierung RCE Betroffenes System: Next.js Frontend + Remote-Produktionsserver Rolle: Cyber Security Praktikant — SenseLive Technologies...

Windows Server Update Service - Insecure Deserialization

Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise. id: CVE-2025-59287 info:...

day09-bentoml-deser-lab

Dia 09 — CVE-2025-27520 desserialização insegura estilo BentoML — Laboratório Docker Local Este laboratório reproduz a classe de desserialização insegura que levou ao CVE-2025-27520. Ele é intencionalmente vulnerável para fins educacionais. Execute apenas localmente no Docker. Início rápido...

sharepoint-toolshell-cve-2025-53770

SharePoint „ToolShell“ RCE-Exploit CVE-2025-53770 Überblick CVE-2025-53770 ist eine kritische Schwachstelle zur Remotecodeausführung RCE in Microsoft SharePoint Server 2016, 2019 und Subscription Edition nur On-Premises, nicht SharePoint Online. Angreifer können die Authentifizierung umgehen und...

CVE-2026-9998-Insecure-Deserialization-in-Blockchain-Oracle

10. CVE-2026-9998 – Deserializzazione non sicura nell'oracolo blockchain Panoramica Un nodo oracolo blockchain deserializza i dati da un evento di smart contract utilizzando pickle di Python, consentendo a un attaccante di eseguire comandi arbitrari. Gravità: Critica Compromissione completa del...

CVE-2023-45185

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Esecuzione di codice remoto tramite deserializzazione non sicura. Cronologia Vulnerabilità segnalata al fornitore: 22.09.2023 Nuova versione corretta 1.1.9.4 rilasciata: 08.12.2023 Divulgazione pubblica: 15.12.2023 Descrizione IBM i Access...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

jboss-deserialization

JBoss Unsichere Deserialisierung zu RCE über CVE-2017-12149. JBoss Unsichere Deserialisierung - RCE-Ausnutzungslabor. Die Idee hier ist, ein Labor mit einer alten JBoss-Version 7.0 einzurichten, um die Schwachstelle auszunutzen. Wir können Docker verwenden, um den gesamten Prozess zu erleichtern...

exploit-react-CVE-2025-55182

FOX-RSC TOOL CVE-2025-55182 & CVE-2025-66478 ESCLUSIONE DI RESPONSABILITÀ LEGALE EN: Questo strumento è una Prova di Concetto PoC destinata esclusivamente alla ricerca sulla sicurezza e a fini educativi. L'utilizzo di questo strumento su sistemi senza autorizzazione esplicita è illegale e punibil...

CVE-2026-0596-Reproduction

CVE-2026-0596: Esecuzione Arbitraria di Codice tramite Deserializzazione Non Sicura nell'Ecosistema MLflow Un rapporto completo di ricerca sulla sicurezza che descrive in dettaglio la verifica, i meccanismi sottostanti e le vulnerabilità architetturali associate alle pipeline di caricamento di...

CVE-2026-76836 AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backendconfig property in backend/src/Entity/Station.php is annotated with GROUPGENERAL, and PUT /api/station/stationid/profile/edit in...

CVE-2026-76843

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-76843

CVE-2026-76843 affects the official Flair wheels for versions 0.15.0 and 0.15.1 . The file flair/models/clustering.py remains present in the distributed package despite being removed from the documented API. Its ClusteringModel.load static method deserializes via pickle.loads(joblib.load(str(mode...