MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
### Summary The `NumpyReader` class in `monai/data/image_reader.py` unconditionally uses `np.load(name, allow_pickle=Tr
#cwe-502
共收录 945 条相关情报。
← 返回所有主题Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch
## Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in `algo_from_pickle()` was fixed in
Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
CVE-2026-74012
Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
CVE-2026-66620
Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON...
CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
CVE-2026-32470
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
CVE-2026-32465
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable...
CVE-2024-13784
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserial...
CVE-2024-13784
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in...
CVE-2026-10035
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due...
CVE-2026-16099
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file pat
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input ...
CVE-2026-10035
The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all vers...
CVE-2026-16099
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file pat
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority -...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to ta
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to ta