ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt ref

CVE-2026-68771 是 ComfyUI v0.23.0 中存在的一个不安全反序列化漏洞，位于 LoadTrainingDataset 节点中。该节点在处理训练数据集时，会使用 torch.load 加载 pickle 格式的文件。由于未对文件内容进行安全校验，远程未认证攻击者可以利用此漏洞执行任意 Python 代码。根据描述，攻击者可通过未认证的 POST /upload/image 接口上传特制的恶意 pickle 文件（如 shard_*.pkl），然后通过 POST /prompt 接口构造工作流请求引用该文件，从而触发反序列化。pickle 协议中的 __reduce__ 方法会被利用来构造恶意对象，导致在 ComfyUI 进程用户权限下执行任意命令。该漏洞影响范围包括所有通过默认配置暴露于网络的 ComfyUI 实例。由于 CVSS 评分为 9.8，且攻击前置条件低（无需认证、无需用户交互、网络可达即可），风险极高。目前没有证据表明该漏洞已被在野利用，也未列入 CISA KEV，但鉴于其严重性，建议立即采取缓解措施，包括限制网络暴露、部署防火墙规则，并关注厂商更新。

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering is enabled, which is off by default) allows an  unauthenticated remote attacker with network access to the clustering port to  execute arbitrary code via a crafted serialized Java object delivered

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering is enabled, which is off by default) allows an  unauthenticated remote attacker with network access to the clustering port to  execute arbitrary code via a crafted serialized Java object delivered

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over a

该漏洞影响 WordPress 的 Fluent Forms Pro Add On Pack 插件，版本 ≤ 6.2.6。由于插件对用户提供的输入进行不安全的反序列化操作，导致存在 PHP 对象注入漏洞。攻击者需要拥有至少 Subscriber 级别的权限，并且目标站点必须启用“用户更新集成”功能，且映射了用户元字段。通过利用 POP 链，攻击者可以修改用户密码，进而劫持管理员账户。CVSS 评分为 8.8（高），攻击向量为网络，复杂度低，无用户交互，影响机密性、完整性和可用性。官方尚未发布补丁，建议用户升级到最新版本（如果可用），临时缓解措施包括禁用“用户更新集成”功能，或限制低权限用户的访问。该漏洞目前未被列入 KEV，也未有公开的在野利用报告。

### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant to allow only `AuthenticatorImpl`, but it short-circuits to `ALLOWED` for any object at stream `depth > 1`. Because the Java serialization filter is consulted for every class in the graph (and `depth == 1` only for the root's concrete class), the allowlist constrains only the root

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0.

### Impact The JDBC spec defines the interface `DataSource`, with a method called `getConnection()`, and `ConnectionPoolDataSource`, with a method called `getPooledConnection()`. These methods are potentially dangerous. One way or another they trigger calls into JDBC drivers, which themselves are complicated, flexible tools which may be, and in practice sometimes have proven to be, susceptible to

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of A

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell command

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC c

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC c

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the abse

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the abse

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Ass

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Ass

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execu

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist,

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and ext

SAP Change and Transport System Attach Tool (ctsattach) 存在一个严重的不安全反序列化漏洞（CVE-2026-58233）。该漏洞允许经过身份验证的攻击者向受害者发送特制的归档文件，当应用程序处理该文件时，会触发不安全的反序列化，进而导致远程代码执行（RCE）。攻击者利用该漏洞可以完全控制受影响的系统，窃取敏感信息，并对系统进程进行操作。漏洞的CVSS评分为7.6（高），攻击复杂度低，但需要用户交互（受害者打开恶意文件）。受影响的产品CVE元数据未明确列出，但可以推测此类工具通常用于SAP环境。建议用户立即关注SAP官方安全公告，并及时应用补丁。在补丁可用前，应限制对此工具的访问，尤其避免来自不可信来源的文件处理。同时，监控系统异常行为以防止潜在利用。该漏洞直接影响数据机密性和完整性，对可用性影响较低。由于没有在野利用或已知利用的证据，目前风险可控，但仍需积极防御。

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.

A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Executing a manipulation of the argument index_meta.faiss can lead to deserialization. The attack may be launched remotely. The exploit has been publicly disclosed an

A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the file run_nerf.py of the component Checkpoint File Handler. The manipulation of the argument ckpt_path leads to deserialization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Th

A vulnerability was detected in yzhao062 pyod 3.5.0/3.5.1/3.5.2. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The pull request to fix this issue requires some minor changes.

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVE-2026-58281 是 Microsoft Edge (基于 Chromium) 中的一个反序列化不可信数据漏洞。攻击者可以利用该漏洞通过网络远程执行代码。漏洞的 CVSS 评分为 8.3，属于高危漏洞。由于攻击需要用户交互（如点击链接）且复杂度较高，但成功利用后可能导致机密性、完整性和可用性完全丧失。受影响的产品是 Microsoft Edge (Chromium-based)，建议用户立即更新到官方发布的最新版本。目前该漏洞尚未被列入已知被利用漏洞列表（KEV），也未有在野利用报告。

该漏洞影响 Spinnaker（开源多云持续交付平台）的多个版本线（2026.x、2025.x）。问题出在 rosco 组件的 Kustomize bake 操作中，对 YAML 标签的处理不安全，导致攻击者可能通过构造恶意的 Kustomize 模板，在 rosco Pod 上执行任意代码。攻击者需具有低权限（PR:L），且需交互（UI:N），但攻击复杂度较高（AC:H）。成功利用可完全破坏机密性、完整性和可用性。官方已在 2026.1.1、2026.0.3、2025.4.4、2025.3.4 版本中修复。建议用户立即升级到修复版本，并限制 rosco 服务的网络暴露以降低风险。

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3,

## Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py ### Summary BabelDOC's vendored PDF parser (`babeldoc/pdfminer/cmapdb.py`) deserializes untrusted pickle data when loading CMap files. The `_load_data()` method strips only NUL bytes from a PDF-controlled CMap name, then passes it directly to `os.path.join()` and `pickle.loads()`. Because Python's `os.path

Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $importedEntries, string $formId): ?array { if (!$this->importdone) { // ... foreach ($importedEntries as $entry) { $entry = unserialize(base64_decode($entry)); // false]` argument; arbitrary classes are instantiated. The subsequent `array_map('strval'

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execu

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or mod

A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes deserialization. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or mod

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Us

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInput

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInput

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 h

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean is provided - neither Haz

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject meth

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is config

A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component Cache Handler. This manipulation of the argument sys.argv[1] causes deserialization. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and ma

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_e

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load().

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code execution.

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization, enabling remote code execution.

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes arbitrary commands when loaded.

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that executes during deserialization, enabling arbitrary code execution in applications loading untrusted pickle data.

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded by victims.

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load() is called.

CVE-2025-71375 影响 picklescan 工具（版本低于 0.0.34），该工具用于扫描 pickle 文件中的恶意代码。漏洞根源在于 picklescan 未能检测到 `_operator.methodcaller` 这一内置函数。攻击者可利用此缺陷构造包含 `_operator.methodcaller` 的恶意 pickle 载荷，成功绕过 picklescan 的检测机制。当目标系统调用 `pickle.load()` 加载该文件时，恶意代码将被执行，导致任意代码执行。CVSS 评分为 8.1（高），攻击复杂度低，无需权限，但需要用户交互（如诱导用户加载恶意 pickle 文件）。漏洞影响机密性和完整性，但可用性未受影响。目前无证据表明该漏洞已被在野利用，也未列入已知被利用漏洞目录（KEV）。受影响产品主要为使用 picklescan 进行 pickle 文件安全扫描的环境，如机器学习模型加载、数据序列化处理场景。建议立即将 picklescan 升级至 0.0.34 或更高版本，同时限制网络暴露，避免从不可信来源加载 pickle 文件，并考虑使用更安全的序列化格式（如 JSON）替代 pickle。

Picklescan 是一款用于检测 pickle 文件中恶意内容的工具。在 0.0.33 之前的版本中，Picklescan 未能检测到 numpy.f2py.crackfortran.getlincoef gadget 在 pickle 序列化的 __reduce__ 方法中的使用。攻击者可以利用此漏洞构造包含该 gadget 的恶意 pickle 文件，当被加载时即可执行任意 Python 代码，从而绕过 Picklescan 的安全检查。该漏洞主要威胁在于供应链投毒场景，即共享 AI 模型文件（通常以 pickle 格式存储）可能被植入后门，导致加载模型的应用或系统被远程控制。虽然 CVSS 评分 8.1（高），但 CVSS 向量中的用户交互（UI:R）要求受害者主动打开恶意文件，降低了自动化攻击风险。目前无证据表明该漏洞已被广泛利用或列入已知被利用漏洞目录（KEV）。受影响用户应尽快升级 Picklescan 至 0.0.33 或更高版本，并建议对来源不可信的 pickle 文件进行额外检查，限制网络共享模型的暴露范围。

CVE-2025-71369 是 picklescan 工具中的一个安全漏洞，影响版本 0.0.28 之前。picklescan 是一个用于检测恶意 pickle 文件的安全扫描工具，但在处理使用 torch.utils.data.datapipes.utils.decoder.basichandlers 的 reduce 方法的 pickle 文件时，无法正确识别恶意载荷。攻击者可以构造特制的 pickle 文件，其中包含通过 basichandlers 调用的恶意代码，从而绕过 picklescan 的安全检查。当受害者反序列化该 pickle 文件时，恶意代码将在目标系统上执行，导致远程代码执行 (RCE)。该漏洞的 CVSS 评分为 8.1（高），攻击向量为网络，攻击复杂度低，无需权限但需要用户交互（如打开文件）。影响包括机密性和完整性的完全丧失，但不影响可用性。该漏洞主要影响使用 PyTorch 框架并依赖 picklescan 进行安全检测的环境。由于 pickle 反序列化是许多机器学习工作流中的常见操作，攻击者可能通过上传恶意模型文件或诱导用户下载来实施攻击。目前厂商尚未提供官方补丁，但建议立即更新 picklescan 至 0.0.28 或更高版本，该版本已修复此绕过问题。同时，应限制网络暴露，避免在不信任的环境中反序列化 pickle 文件，并考虑使用更安全的序列化格式替代。

picklescan 是一款用于检测 Pickle 文件中恶意 payload 的安全工具。在 0.0.34 版本之前，picklescan 未能正确识别 pickle 数据中的 `_operator.attrgetter` 函数调用，导致攻击者可以在 reduce 方法中使用 `_operator.attrgetter` 构造恶意 pickle 文件。当受害者使用 `pickle.load()` 加载该文件时，可能触发任意代码执行。此漏洞允许远程攻击者利用社会工程（如诱使用户加载特制 pickle 文件）绕过 picklescan 的安全检查，实现代码执行。CVSS 评分为 8.1 (High)，攻击向量为网络，攻击复杂度低，无需权限，但需要用户交互。漏洞影响 picklescan < 0.0.34 版本。建议用户立即升级到 0.0.34 或更高版本，同时限制不可信 pickle 文件的加载，并教育用户避免加载来源不明的 pickle 数据。目前无证据表明该漏洞已被在野利用或列入 KEV。

CVE-2025-71366 是一个针对 Python pickle 文件安全扫描工具 picklescan 的绕过漏洞。在 picklescan 0.0.28 之前的版本中，该工具未能正确检测 pickle 文件中通过 torch.utils.bottleneck.__main__.run_cprofile 函数调用的恶意代码。攻击者可以构造特制的 pickle 文件，其中包含该函数调用，从而绕过 picklescan 的安全检查。当受害者加载该 pickle 文件时，攻击者即可实现任意代码执行。该漏洞的 CVSS 评分为 8.1（高），攻击向量为网络，攻击复杂度低，无需特权，但需要用户交互（加载文件），机密性和完整性影响均为高。目前该漏洞尚未被列入已知被利用漏洞目录（KEV），也未发现活跃在野利用。受影响的用户主要是使用 picklescan 进行 pickle 安全检测的开发者和安全团队。建议立即将 picklescan 升级到 0.0.28 或更高版本，以修复该漏洞。此外，应避免从不信任的来源加载 pickle 文件，并考虑启用额外的安全检测机制。

picklescan 是一款用于检测恶意 pickle 文件的安全工具。在版本 0.0.30 之前，picklescan 未能正确识别 asyncio.unix_events._UnixSubprocessTransport._start 函数在 pickle 的 reduce 方法中的使用。攻击者可以构造包含此内置函数的恶意 pickle 文件，该文件能够绕过 picklescan 的静态检测，但在反序列化时执行任意命令，实现远程代码执行。该漏洞影响所有使用 picklescan 进行 pickle 文件检测的系统，尤其在机器学习模型加载、邮件附件扫描等场景中风险较高。攻击者无需认证，但需要用户触发反序列化操作。漏洞的 CVSS 评分为 8.1，属于高危漏洞，可能造成机密性和完整性完全丧失。建议立即升级 picklescan 至 0.0.30 或更高版本，同时限制 pickle 文件来源，避免反序列化不可信数据。

CVE-2025-71362 是影响 Python 安全扫描工具 picklescan（版本 <0.0.33）的一个高危漏洞。picklescan 旨在检测 Pickle 文件中的危险反序列化操作，但其实现存在缺陷：当 Pickle 文件中包含对 numpy.f2py.crackfortran 函数的调用时，picklescan 无法正确识别其中的 eval 调用。攻击者可以利用这一缺陷构造包含恶意代码的 Pickle 文件，当受害者从不可信来源加载该文件时（例如通过 unpickler.load()），恶意代码将在解析过程中被执行，导致机密性和完整性受损。由于 picklescan 本身是安全检测工具，该漏洞意味着依赖该工具的用户可能被绕过，从而加载实际恶意的 Pickle 文件。目前 CVSS 评分为 8.1（高），攻击复杂度低，需要用户交互（如打开文件）。厂商已发布 picklescan 0.0.33 修复该问题。建议用户立即将 picklescan 更新至最新版本，并在使用任何 Pickle 反序列化操作时谨慎对待不可信来源。

CVE-2025-71360 漏洞影响 picklescan 工具 0.0.29 之前的版本。该工具用于检测恶意 pickle 文件，但存在一个缺陷：它无法识别通过 idlelib.calltip.get_entity 函数在 reduce 方法中嵌入的恶意代码。攻击者可以构造特制的 pickle 文件，利用该函数绕过 picklescan 的检查，当受害者在 Python 环境中加载该文件时，恶意代码会执行远程命令。CVSS 评分为 8.1（高），攻击向量为网络，攻击复杂度低，无需身份验证，但需要用户交互（例如打开或加载 pickle 文件）。漏洞影响机密性和完整性（均为高），可用性不受影响。尽管目前没有证据表明该漏洞已在野利用或列入 KEV，但鉴于其潜在的远程代码执行风险，建议所有使用 picklescan 的用户立即升级至 0.0.29 或更高版本。此外，应避免加载来自不可信来源的 pickle 文件，并限制相关应用的网络暴露。

CVE-2025-71359 是 picklescan 工具中的一个绕过漏洞。picklescan 是一款用于检测恶意 pickle 文件的安全扫描工具，其版本低于 0.0.29 时无法检测利用 lib2to3.pgen2.grammar.Grammar.loads 在 reduce 方法中构造的恶意 pickle 载荷。攻击者可以精心制作包含危险代码的 pickle 文件，该文件能够绕过 picklescan 的检测，并在执行 pickle.load() 反序列化时触发远程代码执行（RCE）。攻击者需要诱使用户加载恶意 pickle 文件（例如通过钓鱼邮件或恶意网站），但一旦触发，可导致机密性和完整性受损（CVSS 3.1 评分 8.1，严重程度高）。受影响的用户应尽快将 picklescan 升级至 0.0.29 或更高版本。如果无法立即升级，建议限制 pickle 文件的来源，避免从不信任的来源加载 pickle，并监控系统是否存在异常 pickle 反序列化行为。

CVE-2025-71356 影响 picklescan 工具（版本低于 0.0.28）。picklescan 旨在检测 pickle 文件中的恶意序列化内容，但该版本之前未能识别通过 torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression 函数调用嵌入的恶意代码。攻击者可以构造特制的 pickle 文件，当受害者使用受影响的 picklescan 版本进行扫描或直接加载时，会触发远程代码执行（RCE）。由于 pickle 文件广泛用于机器学习模型分发和数据交换，该漏洞可被利用来投递恶意模型，实现初始访问或横向移动。CVSS 评分为 8.1（高），攻击复杂度低，无需特权，用户交互（加载文件）即可利用，影响机密性和完整性。目前无证据表明该漏洞已在野利用，也未列入 KEV。建议立即升级 picklescan 至 0.0.28 或更高版本，并对 pickle 文件的来源进行严格审查。

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get funct

picklescan 是一个用于检测恶意 pickle 文件的安全工具。在版本 0.0.33 之前，picklescan 无法检测使用 numpy.f2py.crackfortran.param_eval 函数在 reduce 方法中构造的恶意 pickle 文件。攻击者可以通过嵌入特殊构造的 pickle 数据，绕过 picklescan 的安全检查，使得在反序列化时执行任意代码。该漏洞影响所有使用 picklescan 进行 pickle 文件安全性验证的应用，特别是那些加载不受信任 pickle 数据的场景。攻击者无需身份验证即可远程发起攻击，但需要用户交互（如打开恶意文件）。漏洞的 CVSS 评分为 8.1，属于高严重性。由于该工具常用于 AI/ML 模型加载、数据处理等环境，一旦被利用可能导致敏感信息泄露或系统被控制。建议用户立即将 picklescan 升级至 0.0.33 或更高版本，并限制对 pickle 文件的信任来源，避免从不可信源加载数据。

CVE-2025-71345 影响 picklescan 工具（版本低于 0.0.30）。picklescan 用于检测恶意 pickle 文件，但该漏洞导致其无法识别调用 torch.utils.bottleneck.__main__.run_autograd_prof 函数的恶意 pickle 文件。攻击者可以构造特制的 pickle 文件，在反序列化过程中执行任意代码，从而实现远程代码执行（RCE）。CVSS 评分为 8.1（高），攻击向量为网络，无需权限但需用户交互（例如打开恶意文件）。虽然目前未列入已知被利用漏洞目录（KEV）且无在野利用报告，但由于 AI/ML 生态中 pickle 文件的广泛使用，该漏洞具有较高风险。建议用户立即将 picklescan 升级至 0.0.30 或更高版本，同时限制不可信 pickle 文件的网络暴露和使用。

该漏洞影响 picklescan 工具（一个用于检测恶意 pickle 文件的安全扫描器）的 0.0.30 之前版本。picklescan 旨在识别包含恶意代码的 pickle 文件，但漏洞发现其未能检测出利用 Python 标准库中 lib2to3.pgen2.pgen.ParserGenerator.make_label 函数构造的恶意 pickle 文件。攻击者可以制作特殊的 pickle 文件，在 reduce 方法中嵌入恶意代码，该代码能够绕过 picklescan 的检测机制，但当调用 pickle.load() 加载该文件时，会执行任意命令。由于 pickle 序列化格式本身允许在反序列化时执行任意 Python 代码，picklescan 的初衷是作为安全层来阻止此类攻击，但此漏洞使其失效。CVSS 评分为 8.1（高），攻击向量为网络，无需权限，需用户交互（受害者加载恶意 pickle 文件），影响机密性和完整性（完全丢失），但不影响可用性。目前无证据表明已在野利用，也未列入 KEV。受影响产品为 picklescan < 0.0.30。建议用户立即升级到 picklescan 0.0.30 或更高版本，同时在业务环境中严格限制 pickle.load() 的使用，避免加载不可信的 pickle 数据。

picklescan是一个用于检测恶意pickle文件的工具，版本0.0.30之前存在安全漏洞：当攻击者在pickle对象的reduce方法中使用idlelib.run.Executive.runcode时，picklescan无法识别并阻断该恶意payload。由于pickle序列化格式允许通过reduce方法指定任意可调用对象，攻击者可以构造特制的pickle文件，在调用pickle.load()时自动执行嵌入的代码。该漏洞主要影响基于PyTorch的AI模型供应链——攻击者可通过上传恶意pickle模型或数据集，在受害者加载模型时实现远程代码执行，进而窃取数据或植入后门。受影响的版本包括所有0.0.30之前的picklescan发行版。建议措施：立即将picklescan升级到0.0.30或更高版本；在模型加载流程中增加额外的安全校验，例如限制pickle.load的模块白名单；同时避免从不可信来源加载pickle文件。由于该漏洞允许绕过安全检测，且攻击复杂度低，建议优先处理。

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic er

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic er

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Suc

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering w

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=Fal

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the hos

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, Install

c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSource.getPooledConnection() match the getXXX() form, so JavaBean libraries treat them as "properties" assumed safe while they actually call into JDBC drivers. Attac

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.

IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo

The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is

### Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist: ```php if (0 === \strpos($filename, 'phar://')) { throw new \InvalidArgumentException('The output file cannot be a phar archive.'); } ``` PHP stream wrappers are **case-insensitive**, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fix

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to Objec

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys wit

## Summary MessagePack-CSharp's typeless deserialization includes `MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type)` as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, a type that would be blocked directly can be wrapped inside an array

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. T

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. T

## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. This is not the default configur

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to e

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result,

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is valid

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().

picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.

### Summary `glances/outdated.py` uses `pickle.load()` to read a version-check cache file stored at a predictable, world-accessible path (`~/.cache/glances/glances-version.db` or `$XDG_CACHE_HOME/glances/glances-version.db`). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several re

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_string($scheme) && strlen($scheme) > 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path contain

## Summary **Description** A Deserialization of Untrusted Data (CWE-502) issue in OpenDJ's JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The vulnerability exists because the platform reads and processes attacker-controlled bytes prior to authentication. This affects OpenDJ Community Edition through 5.1.0. This has been patched in

### Impact There's an unsafe YAML processing vulnerability that bypasses safe deserialization. This impacts users when when performing: * CloudFormation deployments * CloudFoundry Baking The usage of a non-safe constructor use allows arbitrary loading of Java classes leading to RCE. ### Patches 2025.3.3, 2026.0.3 and 2025.4.4. ### Workarounds Disable the CloudFormation system and cloudfoundry

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not r

picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disrupti

picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disrupti

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

### Summary vcrpy deserializes YAML cassette files with PyYAML's object-constructing loader (`yaml.CLoader` / `yaml.Loader`) instead of the safe loader (`yaml.CSafeLoader` / `yaml.SafeLoader`). A cassette containing a `!!python/object/apply:` (or similar) tag therefore executes arbitrary Python code the moment the cassette is loaded — including through the normal `VCR().use_cassette()` path, befo

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (wh

pgAdmin 4 的 SQL 编辑器蓝图中的两个端点（DELETE /sqleditor/close/<trans_id> 和 POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did>）缺少 @pga_login_required 认证装饰器，导致在服务器模式下，未认证的远程攻击者可以访问这些端点。攻击者通过获取合法的 X-pgA-CSRFToken（可从 /login 端点获得）即可触发 pickle.loads 反序列化操作，处理 session['gridData'][<trans_id>]['command_obj'] 中的恶意数据。但成功利用需要攻击者事先掌握 pgAdmin 的 Flask SECRET_KEY 并具有对 session 目录的写入权限（例如通过配置泄露或服务器其他漏洞获得）。一旦满足这些前提，该漏洞将允许未认证攻击者在 pgAdmin 进程上下文中执行任意代码，进而可能控制主机。受影响版本为 pgAdmin 4 6.9 至 9.16 版本。修复方式是在两个端点上添加 @pga_login_required 装饰器，确保先经过身份验证和 MFA 检查。该漏洞仅在服务器模式下存在，桌面模式不受影响。CVSS 评分为 9.0（严重），攻击复杂度高，但无需特权。建议立即升级至 pgAdmin 4 9.16 或更高版本，并限制 pgAdmin 服务的网络暴露，避免暴露在公网。

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port t

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond w

An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows into a call site that invokes it, achieve remote code execution on the server. 'Elixir.GRPC.Codec.Erlpack':decode/2 (lib/grpc/codec/erlpack.ex) calls :erlang.bi

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.