CVE-2026-61701

Laravel MagicLink (versions 2.0.0 through 2.25.1) is vulnerable to insecure deserialization of serialized action objects stored in the magic_links.action database column. The deserialization path in src/MagicLink.php and src/Actions/ResponseAction.php relies on an unsafe legacy unserialize() fall...

CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-61701 Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

Vulnerability in Cosminexus

Overview Insecure deserialization vulnerability exists in Cosminexus Component Container. These vulnerabilities exist in Cosminexus Component Container which is a component product of other Hitachi products. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory...

PT-2026-91720

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS IBM MQ versions 9.2.0.0 through 9.2.0.43 LTS IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS IBM MQ versions 9.3.0.0 through 9.3.5.1 CD IBM MQ versions 9.4.0.0 through 9.4.0.25 LTS IBM MQ versions...

PT-2026-91265

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

PT-2026-91432

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description Insecure deserialization allows a local attacker to execute arbitrary code. Deserialization is the proces...

PT-2026-91433

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.0 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description Insecure deserialization allows a local attacker to execute arbitrary code. Deserialization is the proces...

EUVD-2026-77001

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...

PT-2026-90941

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexit...

FreeBSD : Gitlab -- vulnerabilities (7fd351d1-af26-11f1-a883-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7fd351d1-af26-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Path Traversal issue in repository commits API impacts GitLab CE/EE Insecure...

Vulnerabilities fixed in Cisco Secure Firewall Management Center

The vulnerability with reference CVE-2026-20079 is located in the web interface of Cisco Secure Firewall Management Center. An unauthenticated remote malicious party can bypass authentication controls by exploiting an incorrect system process created at startup. The malicious party can exploit th...

CVE-2026-84099

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

CVE-2026-82845

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

PT-2026-90570

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

PT-2026-90578

Name of the Vulnerable Software and Affected Versions wpstorecart versions prior to 5.0.8 Description The plugin fails to prevent direct, unauthenticated access to a bundled add-on located at 'paypal.php' within the wpsc-membership-pro component. This allows unauthenticated attackers to inject...

CVE-2026-102270

creationtimestamp| type| source ---|---|--- 2026-09-11 14:20:50+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p...

PT-2026-90041

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Duo Chat access can obtain Advanced Search instance configuration...

PYSEC-2026-3972 PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...

PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability CWE-502 in the checkpoint loading mechanism. The LightningModule.loadfromcheckpoint method, which is commonly used to load saved model states, internally calls torch.load without setting the...