snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC build Either build the jar on your host with mvn clean compile assembly:single Or use docker to build an image with docker build -t snakeyaml . run Run the container with docker run --rm -p8080:8080 snakeyaml or the jar if you built on your host with ja...

EUVD-2025-211178

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

openSUSE 16 Security Update : guava (openSUSE-SU-2026:22143-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22143-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object...

SUSE SLES16 Security Update : guava (SUSE-SU-2026:24263-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24263-1 advisory. This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Jav...

PT-2026-121800

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

Security update for guava (important)

openSUSE security update: security update for guava ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22143-1 Rating: important References: bsc1284985 Cross-References: CVE-2026-102554 CVSS scores: CVE-2026-102554 SUSE : 7.5...

OPENSUSE-SU-2026:22143-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

SUSE-SU-2026:24263-1 Security update for guava

This update for guava fixes the following issue: - CVE-2026-102554: Allocation of resources without limits or throttling CWE-770 during Java object deserialization allows an attacker to cause a Denial of Service via OutOfMemoryError bsc1284985. Changes for guava: - Adapt the generated OSGi data t...

CVE-2026-102554

A flaw was found in Google Guava. During Java object deserialization—the process of converting stored data back into active program objects—memory is eagerly allocated based on caller-specified size parameters without proper throttling or limits. An attacker can exploit this issue by providing a...

PT-2026-122810

Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

SUSE CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

Linux Distros Unpatched Vulnerability : CVE-2026-102554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker t...

UBUNTU-CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

CVE-2026-20211 Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to...

CVE-2026-46495

OpenDJ (LDAPv3 directory service) is vulnerable to unauthenticated Remote Code Execution via its JMX RMI connector prior to version 5.1.1 . The root cause is a Deserialization of Untrusted Data (CWE-502) issue: RmiConnector.java processes attacker-controlled credential objects before authenticati...

Malicious code in integer-slow-java-object-string (npm)

Source: amazon-inspector b338bdd9293fa0282e2edf7b2036cf63e23e3c501b1ede7868c0ed601a40f6e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Missing Release Of Resource After Effective Lifetime

Bouncy Castle is vulnerable to Missing Release of Resource after Effective Lifetime. The vulnerability is due to reliance on Java object finalization to zeroise sensitive key material, which can cause pending finalization queues to grow under load, leading to memory exhaustion and prolonged...

CVE-2026-57527

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

CVE-2026-57527 ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...