DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
CVE-2026-55083
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versi
#cwe-502
共收录 943 条相关情报。
← 返回所有主题A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is proces...
CVE-2026-12544
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a v
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
CVE-2026-97284
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized ...
CVE-2026-102135
On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without suf...
CVE-2026-102108
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a clust
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow craft...
CVE-2026-102101
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Ki
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on...
CVE-2026-13046
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (saml
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler...
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with...
CVE-2026-103041
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization e
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the abilit...
CVE-2026-13046
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (saml
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted seri...
CVE-2026-103041
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization e
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenti...
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system co...
CVE-2026-100308
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep
GluonTS arbitrary command execution during model deserialization
CVE-2026-100308
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecu...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
CVE-2026-83557
### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeIn
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an ...
CVE-2026-81867
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration version
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC end...
CVE-2026-82384
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserializat
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
CVE-2026-82384
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserializat