Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-24232 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | |||||
| CVE-2026-13185 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-10-24 | N/A | 8.1 HIGH |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. | |||||
| CVE-2026-65578 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | |||||
| CVE-2026-67579 | 1 Ash-hq | 1 Ash Framework | 2026-10-24 | N/A | 7.4 HIGH |
| Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3. | |||||
| CVE-2026-59124 | 1 Microsoft | 1 Windows App | 2026-10-24 | N/A | 9.8 CRITICAL |
| Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-65576 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |||||
| CVE-2026-65579 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |||||
| CVE-2026-61484 | 1 Apache | 1 Lucy | 2026-10-24 | N/A | 9.8 CRITICAL |
| ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Lucy is now maintained outside of the ASF at https://github.com/lucysearch . 0.8.0 is no longer affected by this issue, because the offending feature has been removed there. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2026-47623 | 2 Linux, Nvidia | 2 Linux Kernel, Dynamo | 2026-10-24 | N/A | 8.2 HIGH |
| NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering. | |||||
| CVE-2026-68756 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 6.6 MEDIUM |
| A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | |||||
| CVE-2026-65573 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | |||||
| CVE-2026-65577 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | |||||
| CVE-2026-65571 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | |||||
| CVE-2026-67587 | 1 Apache | 1 Airflow | 2026-10-24 | N/A | 8.8 HIGH |
| Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `allowed_deserialization_classes` allow-list, so tightening that setting does not help. A Dag author — who controls a task instance's `next_kwargs` through the task execution API — can therefore cause an arbitrary module to be imported inside the scheduler process, when the scheduler's `awaiting_input` timeout sweep deserializes that value. No non-default configuration is required; the sweep runs unconditionally. Versions before 3.3.0 are not affected: the class existed, but the scheduler sweep that reaches it did not. This is a separate code path from CVE-2026-58076 and CVE-2026-67260, which cover different gadgets reaching deserialization — applying either of those fixes does not address this one. Users are advised to upgrade to apache-airflow 3.3.1 or later. | |||||
| CVE-2026-65574 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | |||||
| CVE-2026-65815 | 1 Microsoft | 1 Dynamics 365 | 2026-10-24 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-65552 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | |||||
| CVE-2026-65572 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | |||||
| CVE-2026-58076 | 1 Apache | 1 Airflow | 2026-10-24 | N/A | 8.8 HIGH |
| Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's `executor_config` reaches that branch, so a Dag author could place a value there that causes an arbitrary callable to be imported and invoked -- for example `subprocess.check_output`, or `builtins.eval` on the `builtins`-prefixed variant. The code runs in the **Scheduler**, which reconstructs serialized Dags in its normal loop with no request involved, and in the **API server**, on any authenticated read of the Dag such as `GET /api/v2/dags/{dag_id}/details`. Both are components the Airflow security model states must never execute Dag-author code, and both hold the metadata database credentials and the JWT signing secret. No non-default configuration is required. This is a **different sink from CVE-2026-33264**, which covered only the trigger branch of the same deserializer: deployments that upgraded in response to that advisory are still affected through the exception branch and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later, which restricts the imported class to a subclass of `BaseException`. | |||||
| CVE-2026-50515 | 1 Microsoft | 1 Azure Service Bus | 2026-10-24 | N/A | 9.9 CRITICAL |
| Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. | |||||