CVE-2026-26220

CVE-2026-26220 affects LightLLM

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

Exploit for CVE-2025-69690

🔐 CVE-2025-69690 & CVE-2025-69691 Authenticated Remote Co...

Unsafe Deserialization

The affected library is vulnerable to Unsafe Deserialization. The vulnerability is due to improper handling of pickle deserialization combined with the use of logging.FileHandler, which allows an attacker to bypass RCE-focused blocklists and create zero-byte files in arbitrary locations on the...

📄 Netgate pfSense Community Edition 2.7.2 / 2.8.0 Remote Code Execution

Netgate pfSense Community Edition versions 2.7.2 and 2.8.0 appear to suffer from multiple authenticated remote code execution vulnerabilities that the vendor has written off as abusive administrator behavior but a non-issue. 🔐 CVE-2025-69690 & CVE-2025-69691 Authenticated Remote Code Execution in...

📄 SolarWinds Web Help Desk Unauthenticated Remote Code Execution

This Metasploit module exploits an access control bypass vulnerability CVE-2025-40536 and an unsafe deserialization vulnerability CVE-2025-40551 to achieve unauthenticated remote code execution against a vulnerable SolarWinds Web Help Desk WHD server. This module requires Metasploit:...

CVE-2026-26215

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

CVE-2026-26215 manga-image-translator Shared API Unsafe Deserialization RCE

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

CVE-2026-26215

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

CVE-2026-26215 manga-image-translator Shared API Unsafe Deserialization RCE

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

CVE-2026-26215

CVE-2026-26215 affects manga-image-translator, beta-0.3 and earlier, in shared API mode. The vulnerability is an unsafe deserialization via Python's pickle.loads() in FastAPI endpoints /simple_execute/{method} and /execute/{method}, processing attacker-controlled request bodies without validation...

CVE-2026-26215 manga-image-translator Shared API Unsafe Deserialization RCE

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote code execution. The FastAPI endpoints /simpleexecute/method and /execute/method deserialize attacker-controlled request bodies using...

GHSA-W8V5-VHQR-4H9V DiskCache has unsafe pickle deserialization

DiskCache python-diskcache through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache...

Exploit for CVE-2026-2969

This repository contains public information for the disclosure o...

Exploit for CVE-2026-22187

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bf...

BIT-CHECKOV-2021-3040 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted...

BIT-CHECKOV-2021-3035 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted...

CVE-2026-25632

EPyT-Flow (Python) prior to version 0.16.1 is affected by a deserialization vulnerability in its REST API. The issue stems from a custom deserializer (my_load_from_json) that honors a type field, allowing attacker-supplied module/class imports and instantiation during JSON parsing, which can trig...

CVE-2026-25632 EPyT-Flow has unsafe JSON deserialization (__type__)

EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer myloadfromjson that supports a type field...