Total
3617 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-105442 | 2026-10-14 | N/A | 7.5 HIGH | ||
| IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service. | |||||
| CVE-2026-97278 | 2026-10-14 | N/A | 7.2 HIGH | ||
| Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9. | |||||
| CVE-2026-12613 | 2026-10-14 | N/A | 8.8 HIGH | ||
| Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21. | |||||
| CVE-2026-108958 | 2026-10-14 | 7.5 HIGH | 6.3 MEDIUM | ||
| A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2025-66455 | 2026-10-14 | N/A | 9.8 CRITICAL | ||
| LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe. | |||||
| CVE-2025-65213 | 1 Mthreads | 1 Torch Musa | 2026-10-14 | N/A | 9.8 CRITICAL |
| MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process. | |||||
| CVE-2026-100214 | 2026-10-14 | N/A | 8.8 HIGH | ||
| Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-65180 | 2026-10-13 | N/A | 7.8 HIGH | ||
| NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering. | |||||
| CVE-2026-65110 | 2026-10-13 | N/A | 7.8 HIGH | ||
| NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering. | |||||
| CVE-2026-106558 | 1 Linuxfoundation | 2 Backstage, Backstage Plugin-techdocs-node | 2026-10-13 | N/A | 8.8 HIGH |
| Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access. This issue is fixed in versions 1.14.8, 1.15.6, and 2.0.1. | |||||
| CVE-2026-108947 | 2026-10-13 | 4.3 MEDIUM | 5.3 MEDIUM | ||
| A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate." | |||||
| CVE-2026-104723 | 2026-10-13 | N/A | 8.8 HIGH | ||
| The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable during lesson creation when a temporary lesson ID triggers the custom metadata path, and requires the attacker to hold a role with the edit_course capability, such as Instructor, Instructor's Assistant, LMS Manager, or Administrator. | |||||
| CVE-2026-12626 | 2026-10-13 | N/A | 7.2 HIGH | ||
| The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available. | |||||
| CVE-2026-78535 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | |||||
| CVE-2026-78529 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | |||||
| CVE-2026-81797 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | |||||
| CVE-2026-78531 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | |||||
| CVE-2026-78533 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | |||||
| CVE-2026-66569 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | |||||
| CVE-2026-93934 | 2026-10-13 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. | |||||