#cwe-502

共收录 943 条相关情报。

← 返回所有主题

漏洞预警2026-10-31 发布CRITICAL

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application...

CVE-2026-118636

**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-31 发布CRITICAL

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the '...

CVE-2026-109220

The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Inject

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-30 发布INFO

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remot...

CVE-2026-63393

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 u

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in...

CVE-2026-16760

In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-693 #severity:high

漏洞预警2026-10-30 发布HIGH

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted qualname (for example "Values.read_file") is resolved by pickle's find_class throug...

CVE-2026-118938

In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Val

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #cwe-706 #severity:high

漏洞预警2026-10-30 发布HIGH

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integrati...

CVE-2026-62848

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 202

来源摘录 · NVD

#cve #cwe-502 #cwe-913

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CVE-2026-90888

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:critical

漏洞预警2026-10-30 发布HIGH

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

CVE-2026-78527

Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high

漏洞预警2026-10-30 发布HIGH

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

CVE-2026-73186

Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-502 #severity:high

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

CVE-2026-39738

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布CRITICAL

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

CVE-2026-119526

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Roy

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

CVE-2026-118090

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

CVE-2026-118089

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布INFO

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts cl...

CVE-2026-61803

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-502

漏洞预警2026-10-30 发布CRITICAL

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remot

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布INFO

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an...

CVE-2026-93327

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versio

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unseriali...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `publ

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布CRITICAL

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This i...

CVE-2026-103039

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布HIGH

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored m

来源摘录 · NVD

#cve #cwe-502

漏洞预警2026-10-30 发布INFO

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

CVE-2026-118562

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affect

来源摘录 · NVD

#cve #cwe-502