npm: Seroval: Script injection through RegExp sources in serialized output

npm: Seroval: Script injection through RegExp sources in serialized output vulnerability discovered by ? in WordPress npm seroval versions 1.0.0...

CVE-2026-116796

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116796: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript...

CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

npm: Serialize JavaScript: Cross-site scripting XSS via unescaped /script at the end of a serialized function body vulnerability discovered by ? in WordPress npm serialize-javascript versions 7.1.3...

CVE-2026-115886

A flaw was found in MLflow. An unauthenticated remote attacker can conduct Server-Side Request Forgery SSRF, where the application is tricked into making unauthorized network requests to arbitrary internal or external systems. By submitting crafted serialized scorer data to affected endpoints, an...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CVE-2026-115897

The Serialize JavaScript library is vulnerable to Cross-site Scripting (XSS) in versions prior to 7.1.3 . The root cause is that the function-source escaping logic fails to neutralize a bare "&gt; prefix when attacker-influenced source text ends exactly at that prefix. Because function bodies are...

CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix...

CLEANSTART-2026-UD61469 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...

PT-2026-122240

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.1.3 Description The software fails to properly neutralize a bare closing-script prefix when the source text of a function ends exactly with that prefix. Because function bodies are escaped independently...

CVE-2026-114403

The PHPOffice PHPPresentation library (versions through 1.2.0 ) is vulnerable to an insecure deserialization flaw in the Reader bSerialized::load function. An attacker can exploit this by uploading a crafted ZIP file containing a PhpPresentation.xml file. When IOFactory::load processes this file,...

CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize,...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the getSerializer method in RedisConfiguration in the Spring Redis component. When no custom serializer is configured, an attacker able to publish to a subscribed Redis channel can send a crafted...

CVE-2026-78165

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

EUVD-2026-104221

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : c3p0 vulnerabilities (USN-8642-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8642-1 advisory. It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized...

CVE-2026-93447

IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process...

CLEANSTART-2026-IB65674 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...