共收录 945 条相关情报。
← 返回所有主题CVE-2026-24240
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted dat
CVE-2026-10538
Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowe
CVE-2026-56700
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Sch
CVE-2026-55223
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can c
CVE-2025-71374
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce met
CVE-2025-71371
picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce meth
CVE-2025-71368
picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attacke
CVE-2025-71363
picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to exe
CVE-2025-71350
picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce met
CVE-2025-71349
picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing att
CVE-2026-7871
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application pri
CVE-2026-13759
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, Objec
CVE-2026-12578
The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitr
CVE-2026-12240
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat
CVE-2026-49286
### Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-s
CVE-2026-46386
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docke
CVE-2026-57527
Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows
CVE-2026-56057
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
CVE-2026-56055
Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.
CVE-2026-56032
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.