2305 matches found
EUVD-2026-64849
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-76843
CVE-2026-76843 affects the official Flair wheels for versions 0.15.0 and 0.15.1 . The file flair/models/clustering.py remains present in the distributed package despite being removed from the documented API. Its ClusteringModel.load static method deserializes via pickle.loads(joblib.load(str(mode...
CVE-2025-53770-Scanner
🛡️ Scanner de Vulnerabilidade CVE-2025-53770 no SharePoint Uma ferramenta baseada em Python para detectar instâncias vulneráveis do Microsoft SharePoint afetadas por CVE-2025-53770 , uma vulnerabilidade de desserialização insegura acionada através do endpoint ToolPane.aspx. O scanner envia um...
PT-2026-80853
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodel file and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-76320
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:00+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-76395
Splunk AI Toolkit versions below 6.0.0 deserialize sparse matrix data containing embedded pickle payloads without validation, allowing a user with the "power" role to execute arbitrary code via the model-loading REST API. The fix is to upgrade to version 6.0.0 or later. No in-the-wild exploitatio...
GHSA-5XWG-CFVJ-GFF5 vulnerabilities
Vulnerabilities for packages: traccar-fips, logstash-fips, traccar, zipkin, conductor-fips, druid, logstash, cassandra-reaper, nuxeo, conductor, thingsboard...
CVE-2025-14600
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
CVE-2025-14600
vsDesk, a PHP/Yii2 helpdesk application, contains an insecure deserialization flaw (titled as path traversal) enabling unauthenticated remote attackers to manipulate configuration data, redirect LDAP authentication to an attacker-controlled server, and provision a new admin account. CVSS 4.0 scor...
CVE-2025-14600 Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
EUVD-2025-210742
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
MINI-H498-GRPW-2M86
Bulletin has no description...
PT-2026-78822
Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 6.0.0 Description A user with the "power" Splunk role can execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. This occurs because a model codec...
PT-2026-78540
Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0402 Description An insecure deserialization issue allows a remote attacker to obtain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to...
CVE-2025-14600: Authentication Bypass by Primary Weakness
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...
CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20
CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20. A patched version of the package is available...
ROS-20260817-73-0011
The vulnerability of .NET and Microsoft Visual Studio software platforms is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
