1914 matches found
CVE-2026-4416 GIGABYTE｜Performance Library - Insecure Deserialization
The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation...
WatchGuard Fireware OS 安全漏洞
WatchGuard Fireware OS is a software operated by the American company WatchGuard, running on Firebox devices. Versions 12.1 to 12.11.8 and 2025.1 to 2026.1.2 of WatchGuard Fireware OS contain security vulnerabilities due to insecure deserialization, which may allow arbitrary code to be executed i...
PT-2026-28807
Name of the Vulnerable Software and Affected Versions Gigabyte Control Center versions affected versions not specified Description The Performance Library component of Gigabyte Control Center contains an issue where maliciously serialized data can be sent to the EasyTune Engine service. An...
GIGABYTE Control Center 代码问题漏洞
GIGABYTE Control Center is an open-source hardware management and system tuning tool developed by GIGABYTE of Taiwan, China. GIGABYTE Control Center has a code vulnerability that stems from insecure deserialization in the Performance Library component. This vulnerability could allow authenticated...
GRID::Machine 安全漏洞
GRID::Machine is an open-source Perl module developed by Openwall for distributed task scheduling and remote execution. Versions of GRID::Machine prior to 0.127 contain security vulnerabilities, which stem from insecure deserialization mechanisms. These vulnerabilities could allow arbitrary code ...
websec-payloads
Web Security Payloads & Exploitation Reference Comprehensiv...
GHSA-RF88-776R-RCQ9 Saloon has insecure deserialization in AccessTokenAuthenticator
Impact Users of the OAuth2 utilities in Saloon, specifically the AccessTokenAuthenticator class. Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 Description The Saloon PHP library used PHP's unserialize in AccessTokenAuthenticator::unserialize ...
Saloon has insecure deserialization in AccessTokenAuthenticator
Impact Users of the OAuth2 utilities in Saloon, specifically the AccessTokenAuthenticator class. Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 Description The Saloon PHP library used PHP's unserialize in AccessTokenAuthenticator::unserialize ...
CVE-2026-33942 Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)
Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize in AccessTokenAuthenticator::unserialize to restore OAuth token state from cache or storage, with allowedclasses = true. An attacker who can control the serialized...
CVE-2026-33942
Saloon PHP library prior to version 4.0.0 deserializes OAuth token state via PHP unserialize() in AccessTokenAuthenticator::unserialize() with allowed_classes enabled. An attacker who controls the serialized data (e.g., by overwriting a cached token or injection) can submit a gadget object; upon ...
CVE-2026-33942 Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)
Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize in AccessTokenAuthenticator::unserialize to restore OAuth token state from cache or storage, with allowedclasses = true. An attacker who can control the serialized...
CVE-2026-33942 Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)
Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize in AccessTokenAuthenticator::unserialize to restore OAuth token state from cache or storage, with allowedclasses = true. An attacker who can control the serialized...
NVIDIA Model Optimizer 代码问题漏洞
NVIDIA Model Optimizer is a tool component developed by NVIDIA Corporation that optimizes the performance of deep learning models and improves inference efficiency. NVIDIA Model Optimizer has a code vulnerability, which stems from an insecure deserialization issue in the ONNX quantization functio...
NVIDIA Megatron-LM 代码问题漏洞
NVIDIA Megatron-LM is a distributed training framework based on PyTorch developed by NVIDIA Corporation in the United States. It is specifically designed for training large-scale Transformer language models. NVIDIA Megatron-LM has code vulnerabilities, particularly an issue related to the...
SuiteCRM 代码问题漏洞
SuiteCRM is a customer relationship management system developed by the SuiteCRM team. Versions of SuiteCRM 8.9.2 and earlier contained a code vulnerability. This vulnerability stemmed from insecure deserialization in the SavedSearch filter processing component, which could allow authenticated...
Vulnerabilities fixed in Cisco Secure Firewall Management Center
The vulnerability with reference CVE-2026-20079 is located in the web interface of Cisco Secure Firewall Management Center. An unauthenticated remote malicious party can bypass authentication controls by exploiting an incorrect system process created at startup. The malicious party can exploit th...
EUVD-2026-12954
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code...
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
Description The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...
GHSA-2PM6-9FHX-VVG3 The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class
Description The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...
VulnCheck KEV: CVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java...