#cwe-502

共收录 943 条相关情报。

← 返回所有主题
漏洞预警2026-09-20 发布MEDIUM

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util...

CVE-2026-94093

CVE-2026-94093 涉及 DLR-RM 维护的强化学习库 stable-baselines3(影响 2.9.0 及之前版本)。该库的模型持久化工具文件 save_util.py 在 PPO.load、load_replay_buf

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-20 发布INFO

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path r...

CVE-2026-94092

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file u

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-20 发布INFO

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipul...

CVE-2026-94091

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file ge

历史摘要 · 未重新核验 · NVD

安全公告2026-09-20 发布INFO

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability...

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-20 发布INFO

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data throug...

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX actio

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes...

CVE-2026-93872

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comment

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute...

CVE-2026-81657

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in...

CVE-2026-11711

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service componen

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write ...

CVE-2026-93872

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comment

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-81657

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

CVE-2026-11711

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service componen

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disag...

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

CVE-2025-66455

## Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages rec

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-18 发布INFO

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-18 发布INFO

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception h...

CVE-2026-10751

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applicati

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-18 发布INFO

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via ...

CVE-2026-17086

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object I

历史摘要 · 未重新核验 · NVD

安全公告2026-09-18 发布INFO

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated...

CVE-2026-93467

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execu

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-18 发布INFO

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously cr...

CVE-2026-93467

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execu

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controll...

CVE-2026-54752

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The vali

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-17 发布INFO

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to rejec...

CVE-2026-76834

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array obje

历史摘要 · 未重新核验 · NVD