Export limit exceeded: 414056 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3782 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12155 | 1 Ibm | 3 Mq Advanced Container Images, Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. | ||||
| CVE-2026-12148 | 1 Ibm | 3 Mq Advanced Container Images, Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | 7.5 High |
| IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | ||||
| CVE-2026-111628 | 2026-10-23 | 5 Medium | ||
| 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes. | ||||
| CVE-2026-98924 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-23 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount. Each time evict_inodes() drops s_inode_list_lock to reschedule, it restarts the walk from the head of s_inodes. With many referenced inodes at the head of the list, these restarts repeatedly scan the same inodes without reclaiming them. This can keep s_umount held for a long time, blocking concurrent umount attempts and triggering hung-task reports. Keep the current inode, already marked I_FREEING, out of the disposal batch until s_inode_list_lock is reacquired. Resume the walk from this inode and dispose of it in a later batch or at the end of the walk. The zero-refcount and state checks under i_lock allow this walker to claim the inode by setting I_FREEING and removing it from the LRU. Other reclaimers skip the inode, leaving this walker responsible for eviction. Only evict() removes it from s_inodes, so keeping it out of the disposal batch ensures that it remains on the list while the lock is dropped. After reacquiring the lock, reading its current next pointer accounts for concurrent removal of following inodes. The existing inode lifetime rules prohibit acquiring a reference to an inode marked I_FREEING or I_WILL_FREE. __iget() requires its caller to hold i_lock and establish that taking a reference is valid. Inode lookup and igrab() check these flags under i_lock when acquiring a reference from zero. ihold() requires an existing reference, which would keep i_count nonzero and prevent this walker from claiming the inode. These rules already allow iput_final() and the inode shrinker to release i_lock after setting I_FREEING and before eviction completes. A temporary __iget() reference would also keep the inode on the list, but its release must preserve last-reference handling. Another user can acquire a reference, update lazy timestamps and drop its reference while the pin is held. If the pin becomes the last reference, dropping it with atomic_dec_and_test() and evicting directly bypasses iput()'s lazytime handling and can lose those timestamp updates. Releasing the pin with iput() preserves that handling, but does not guarantee eviction. fs_bdev_mark_dead() runs with SB_ACTIVE set, so iput() may retain the inode in cache, whereas evict_inodes() must evict eligible zero-reference inodes. The inode may also have been freed when iput() returns, so the walker cannot then use it to force eviction. Using I_FREEING preserves the existing eviction behavior without introducing an additional last-reference transition. The xfstests auto group passed on ext4 and XFS with known unrelated failures excluded. No new issues were observed, and the previously reproducible hung task no longer occurs with this patch. | ||||
| CVE-2026-12350 | 1 Ibm | 3 Mq Advanced Container Images, Mq Operator, Supplied Mq Advanced Container Images | 2026-10-23 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. | ||||
| CVE-2026-112857 | 2026-10-23 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8. | ||||
| CVE-2026-112853 | 2026-10-23 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1. | ||||
| CVE-2026-110874 | 1 Dolibarr | 3 Dolibarr, Dolibarr Erp/crm, Dolibarr Erp\/crm | 2026-10-23 | 6.6 Medium |
| Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation. | ||||
| CVE-2026-111160 | 1 Modeltc | 1 Lightllm | 2026-10-23 | 7.5 High |
| LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart. | ||||
| CVE-2026-64610 | 2 Apache, Apache Software Foundation | 2 Apache Kylin, Apache Kylin | 2026-10-23 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue. | ||||
| CVE-2026-104730 | 2 Sunshinephotocart, Wordpress-extensions | 2 Sunshine Photo Cart, Sunshine Photo Cart | 2026-10-23 | 9.8 Critical |
| The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery. | ||||
| CVE-2026-112862 | 2 Wordpress-extensions, Xnau Webdesign | 2 Participants Database, Participants Database | 2026-10-23 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5. | ||||
| CVE-2025-30047 | 1 Cgm | 1 Cgm Clininet | 2026-10-23 | N/A |
| CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3 | ||||
| CVE-2026-16477 | 1 Mtw | 1 Cleanshot X | 2026-10-22 | N/A |
| CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10 | ||||
| CVE-2026-114608 | 1 Pylint-dev | 1 Pylint | 2026-10-22 | 6.7 Medium |
| Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9. | ||||
| CVE-2026-82814 | 2026-10-22 | 8.8 High | ||
| The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required. | ||||
| CVE-2026-93905 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-10-22 | 8.2 High |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. | ||||
| CVE-2026-114403 | 1 Phpoffice | 1 Phppresentation | 2026-10-22 | 8.1 High |
| PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service. | ||||
| CVE-2026-114197 | 1 Mandiant Flare | 1 Capa | 2026-10-22 | N/A |
| Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility | ||||
| CVE-2026-114198 | 1 Mandiant Flare | 1 Floss | 2026-10-22 | N/A |
| Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility | ||||