CVE-2026-61765

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61769

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61769). An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution , data tampering , and information disclosure . The...

EUVD-2026-69313

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-61754

CVE-2026-61754 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7...

CVE-2026-61756

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

Security Bulletin: NVIDIA Dynamo - August 2026

NVIDIA has released a software update for NVIDIA® Dynamo. To protect your system, clone or update this software from the NVIDIA ai-dynamo/dynamo GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

PT-2026-65013

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally...

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network...

PYSEC-2026-1654 MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

CVE-2026-46590

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the lib2to3.pgen2.grammar.Grammar.loads function. An attacker can execute arbitrary code by providing a...

Deserialization of Untrusted Data

Overview megatron-bridge is a Megatron Bridge: Training Recipes for Megatron-based LLM and VLM models Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process. An attacker can execute arbitrary code, escalate privileges, tamper with data...

CVE-2026-24249

CVE-2026-24249 affects NVIDIA Megatron Bridge for Linux and describes deserialization of untrusted data leading to potential code execution, privilege escalation, data tampering, and information disclosure. The NVIDIA security bulletin confirms this vulnerability is addressed in the security upda...

PT-2026-54894

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.46.0 MediaWiki versions prior to 1.45.4 MediaWiki versions prior to 1.44.6 MediaWiki versions prior to 1.43.9 Description An unsafe deserialization of untrusted data exists in the LogItem import process. This issu...

CVE-2026-12578

CVE-2026-12578 affects Delta Electronics DTM Soft and is associated with a deserialization of untrusted data that may allow arbitrary code execution. Connected sources describe the vulnerable component as part of DTM Soft, with exploitation potentially enabling privilege escalation and lateral mo...