CVE-2026-47864

Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request with Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly via r...

CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

Mida eFramework <=2.9.0 - Remote Command Execution

Mida eFramework through 2.9.0 allows an attacker to achieve remote code execution with administrative root privileges. No authentication is required. id: CVE-2020-15920 info: name: Mida eFramework =2.9.0 - Remote Command Execution author: dwisiswant0 severity: critical description: Mida eFramewor...

Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-

ट्रायेज: CVE-2021-26855 ProxyLogon - Microsoft Exchange इस लैब में, लक्ष्य एक प्रसिद्ध वास्तविक दुनिया की भेद्यता का ट्रायेज उसी तरह अभ्यास करना था जैसे एक सुरक्षा टीम करती है: CVE विवरण पढ़ना, CVSS स्कोर समझना, और यह तर्क करना कि स्थिति के आधार पर यह वास्तव में कितना जोखिम भरा है। चरण 1: NVD में...

EUVD-2026-66761

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

PT-2026-82772

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may b...

PT-2026-82569

Name of the Vulnerable Software and Affected Versions ToolUniverse versions prior to 1.3.0 Description The software executes caller-supplied Python code within a sandbox that can be escaped. The executor in python executor tool.py uses a denied list for attribute names and calls but fails to bloc...

PT-2026-82835

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.4.0 through 4.14.6 Description A flaw in the cluster file synchronization process allows an entity possessing the cluster key to write, overwrite, or delete arbitrary files within the /var/ossec directory on worker nodes,...

Zimbra Collaboration Suite 10.1.19 SMTP Command Injection

Zimbra Collaboration Suite versions prior to 10.1.20 contain an OS command injection vulnerability in the optional zimbra-snmp package when SNMP notifications are enabled. This exploit injects a crafted service status message through an unauthenticated SMTP recipient address, causing the SNMP...

CVE-2026-37003

Agno (AI agent framework) versions up to and including 2.5.8 are vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run()...

CVE-2026-37007

A vulnerability in FileWriterTool in crewai-tools = 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument...

EUVD-2026-67122

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

CVE-2026-30612

Time4 Popcorn (Windows ≤ 6.2.1.18, macOS ≤ 6.2.1.17, Android ≤ 3.5.0.173) contains a vulnerability that allows a remote attacker to execute arbitrary code via the updater.exe component on Windows and the PT.updd component on macOS. The underlying root cause is not further detailed in the provided...

CVE-2026-75357

Bilibili Desktop v.1.17.9 contains a vulnerability in the bili-inject.js and bili-bridge.js components that allows a remote attacker to execute arbitrary code without requiring authentication or user interaction. The vulnerability is rated CVSS 9.8 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/...

CVE-2026-75357

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

CVE-2026-37007

CVE-2026-37007 affects the FileWriterTool component in crewai-tools versions

PT-2026-82557

Name of the Vulnerable Software and Affected Versions Netron versions prior to 9.1.3 Description The desktop application contains a Reflected Cross-Site Scripting XSS flaw caused by unsanitized node names. This allows an attacker to hide specific nodes, conduct port scanning, or leverage a Chrome...

PT-2026-82558

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description The Twig sandbox mechanism is configured to allow dangerous functionality from the Yii framework. This configuration allows authenticated users to achieve Remote Code Execution RCE, which i...