Total
3246 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-21568 | 1 Microsoft | 2 Sql Server 2019 Integration Services, Sql Server 2022 Integration Services | 2026-08-19 | N/A | 7.3 HIGH |
| Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability | |||||
| CVE-2023-21529 | 1 Microsoft | 1 Exchange Server | 2026-08-19 | N/A | 8.8 HIGH |
| Microsoft Exchange Server Remote Code Execution Vulnerability | |||||
| CVE-2025-2251 | 2026-08-19 | N/A | 6.2 MEDIUM | ||
| A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication. | |||||
| CVE-2026-59940 | 2026-08-18 | N/A | 9.8 CRITICAL | ||
| Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3. | |||||
| CVE-2026-69659 | 1 Ash-hq | 1 Ash Framework | 2026-08-18 | N/A | 5.5 MEDIUM |
| Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node. This issue affects ash: from 1.17.0 before 3.31.1. | |||||
| CVE-2026-67579 | 1 Ash-hq | 1 Ash Framework | 2026-08-18 | N/A | 7.4 HIGH |
| Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3. | |||||
| CVE-2026-19826 | 2026-08-18 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation. | |||||
| CVE-2026-10571 | 4 Apple, Ibm, Linux and 1 more | 7 Macos, Aix, I and 4 more | 2026-08-17 | N/A | 5.7 MEDIUM |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled. | |||||
| CVE-2026-65815 | 1 Microsoft | 1 Dynamics 365 | 2026-08-17 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-27727 | 1 Mchange | 1 Mchange Commons Java | 2026-08-17 | N/A | 9.8 CRITICAL |
| mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened. Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions prior to 0.4.0 should be avoided on application CLASSPATHs. | |||||
| CVE-2026-25747 | 1 Apache | 1 Camel | 2026-08-17 | N/A | 8.8 HIGH |
| Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5 | |||||
| CVE-2026-59124 | 1 Microsoft | 1 Windows App | 2026-08-16 | N/A | 9.8 CRITICAL |
| Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2020-0618 | 1 Microsoft | 1 Sql Server | 2026-08-15 | 6.5 MEDIUM | 8.8 HIGH |
| A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'. | |||||
| CVE-2026-28149 | 2026-08-14 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | |||||
| CVE-2026-28176 | 2026-08-14 | N/A | 8.8 HIGH | ||
| Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. | |||||
| CVE-2026-27380 | 2026-08-14 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | |||||
| CVE-2026-62912 | 1 Microsoft | 2 Exchange Server, Exchange Server Subscription Edition | 2026-08-13 | N/A | 6.5 MEDIUM |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. | |||||
| CVE-2026-70321 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-66808 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-66805 | 1 Microsoft | 1 Sharepoint Server | 2026-08-13 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | |||||