#cwe-502

共收录 945 条相关情报。

漏洞预警2026-07-04 发布HIGH

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed ...

CVE-2025-71356

CVE-2025-71356 影响 picklescan 工具（版本低于 0.0.28）。picklescan 旨在检测 pickle 文件中的恶意序列化内容，但该版本之前未能识别通过 torch.fx.experimental.symbo

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-04 发布INFO

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files w...

CVE-2025-71353

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get funct

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-04 发布HIGH

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks...

CVE-2025-71347

picklescan 是一个用于检测恶意 pickle 文件的安全工具。在版本 0.0.33 之前，picklescan 无法检测使用 numpy.f2py.crackfortran.param_eval 函数在 reduce 方法中构造的

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-04 发布HIGH

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.main.run_autograd_prof function. Attackers can embed undetected code in pi...

CVE-2025-71345

CVE-2025-71345 影响 picklescan 工具（版本低于 0.0.30）。picklescan 用于检测恶意 pickle 文件，但该漏洞导致其无法识别调用 torch.utils.bottleneck.__main__.r

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-04 发布HIGH

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft mal...

CVE-2025-71343

该漏洞影响 picklescan 工具（一个用于检测恶意 pickle 文件的安全扫描器）的 0.0.30 之前版本。picklescan 旨在识别包含恶意代码的 pickle 文件，但漏洞发现其未能检测出利用 Python 标准库中 li

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-04 发布HIGH

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that e...

CVE-2025-71342

picklescan是一个用于检测恶意pickle文件的工具，版本0.0.30之前存在安全漏洞：当攻击者在pickle对象的reduce方法中使用idlelib.run.Executive.runcode时，picklescan无法识别并阻

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

安全公告2026-07-03 发布INFO

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to...

CVE-2026-12481

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deser

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-502 #severity:high

漏洞预警2026-07-03 发布INFO

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_rai...

CVE-2026-12481

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deser

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implement...

CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool.

历史摘要 · 未重新核验 · NVD

#cve #cwe-470 #cwe-502

漏洞预警2026-07-01 发布INFO

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to th...

CVE-2026-14265

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 t

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar...

CVE-2026-57516

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to a

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any ...

CVE-2026-58127

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registere

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-502

漏洞预警2026-07-01 发布INFO

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed ...

CVE-2026-58126

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-306 #cwe-502

漏洞预警2026-07-01 发布INFO

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includ...

CVE-2026-58025

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vuln...

CVE-2026-24251

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might l...

CVE-2026-24250

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed i

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead ...

CVE-2026-24247

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead ...

CVE-2026-24245

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead ...

CVE-2026-24244

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-07-01 发布INFO

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead ...

CVE-2026-24243

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-502