EUVD-2026-67579

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...

CVE-2026-78032

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...

CVE-2026-78032

SOY CMS is affected by a deserialization of untrusted data vulnerability that allows an attacker to execute arbitrary code with web server privileges . The vulnerability is rated CRITICAL with a CVSS 3.0 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 base score of 9.3 . No...

PT-2026-83084

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.7.2 Description An issue involving the deserialization of untrusted data allows for PHP object injection, which can be chained from an unauthenticated starting point to achieve remote code execution. The attack...

CVE-2026-15679

A flaw was found in Hugging Face PyTorch Image Models. A remote attacker could exploit a deserialization of untrusted data vulnerability by enticing a user to visit a malicious page or open a malicious file. This could lead to arbitrary code execution in the context of the current process. The fl...

CVE-2026-47875

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-15387

GitLab EE is affected by an acceptance of extraneous untrusted data with trusted data issue in versions 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 . The root cause is improper handling of job dependencies , which allows an authenticated user with developer-role permissions to ...

CVE-2026-15387 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy...

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

Ajax.NET Professional AjaxPro contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a...

Astra Linux – Vulnerability in Apache Log4j1.2

In Log4j 1.2, the JMSAppender component is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide configurations for TopicBindingName and TopicConnectionFactoryBindingName, causing the JMSAppender to make JNDI reques...

Astra Linux – Vulnerability in node-semver

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Astra Linux – Vulnerability in libgoogle-gson-java

The com.google.code Gson:gson package before version 2.8.9 is vulnerable to deserialization of untrusted data through the writeReplace method in internal classes, which may lead to DoS attacks...

Astra Linux – Vulnerability in protobuf

Any project that uses the Protobuf Pure-Python backend to parse untrusted Protocol Buffers data—which may contain an arbitrary number of recursive groups, recursive messages, or a series of SGROUP tags—can be corrupted when the Python recursion limit is exceeded. This can lead to a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: crypto: marvell/octeontx – prevents integer overflows The value of “codelength” comes from the firmware file. If your firmware is untrusted, there’s probably very little you can do to protect yourself. Nevertheless, we still t...

Astra Linux – Vulnerability in PostgresSQL 11

Inclusion of untrusted data in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for execution during the restore process, as the client operating system account running psql restores the dump using psql meta-commands. pgdumpall is also affected...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are vulnerable to SQL injection if untrusted data is used as a kind/lookupname value. Applications that restrict the choice of lookup names and kinds to a known safe list are not...

Astra Linux – Vulnerability in golang-github-golang-jwt-jwt

golang-jwt is a Go implementation of JSON Web Tokens. Starting from version 3.2.0 and before versions 5.2.2 and 4.5.2, the parse.ParseUnverified function splits its argument which is untrusted data using periods. As a result, in the case of a malicious request where the Authorization header...

Astra Linux – Vulnerability in protobuf

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups/series of SGROUP tags can be corrupted due to exceeding the stack limit, i.e., StackOverflow. Parsing nested groups as unknown fields using the DiscardUnknownFieldsParser or the Java Protobuf...

Astra Linux – Vulnerability in pyyaml

In PyYAML before version 5.1, the yaml.load API could execute arbitrary code if used with untrusted data. The load function has been deprecated in version 5.1, and the 'UnsafeLoader' has been introduced to maintain backward compatibility with this function...

EUVD-2026-63756

A Server-Side Request Forgery SSRF vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...