A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low.
Users are recommended to upgrade to Apache Airflow 3.2.0, which resolves this issue.
Deserialization of Untrusted Data vulnerability in Apache Storm.
Versions Affected:
before 2.8.6.
Description:
When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs.
Mitigation:
2.x users should upgrade to 2.8.6.
Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6.
Credit: This issue was discovered by K.
Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort.
This issue affects escarogt prior to commit hash
97e8115ab1110bc502b4b5e4a0c689a71520d335
CVE-2026-3199 is a critical vulnerability in Sonatype Nexus Repository versions 3.22.1 through 3.90.2. It affects the task management component, allowing an authenticated attacker with task creation permissions to execute arbitrary code by bypassing the nexus.scripts.allowCreation security control. The vulnerability is related to deserialization of untrusted data (CWE-502). The CVSS 4.
CVE-2026-39890 is a critical vulnerability in MervinPraison PraisonAI versions prior to 4.5.115. The vulnerability arises from unsafe deserialization of YAML files using the js-yaml library without disabling dangerous tags, allowing attackers to execute arbitrary JavaScript code remotely by uploading malicious agent definition files. This leads to remote code execution on the server hosting the vulnerable application. The issue is fixed in version 4.5.115. No known exploits in the wild have been reported yet.
A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and react-server-dom-webpack (versions 19.0.0 through 19.0.4, 19.1.0 through 19.1.5, and 19.2.0 through 19.2.4). The vulnerability is triggered by sending specially crafted HTTP requests to Server Function endpoints.The payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable.
The Everest Forms WordPress plugin up to version 3.4.3 contains a critical vulnerability (CVE-2026-3296) involving PHP Object Injection via unsafe deserialization of untrusted input from form entry metadata. An unauthenticated attacker can inject a serialized PHP object payload through any public form field, which is stored in the database and later unserialized without class restrictions when an administrator views entries. This can lead to full system compromise due to the high severity of the vulnerability.
CVE-2026-3357 is a high-severity vulnerability in IBM Langflow Desktop versions 1.6.0 through 1.8.2. It involves insecure deserialization of untrusted data in the FAISS component, which could allow an authenticated user to execute arbitrary code on the affected system. The vulnerability arises from an insecure default setting that permits this unsafe deserialization. There is no vendor advisory or patch information currently available for this vulnerability. The CVSS score is 8.8, indicating a high impact on confidentiality, integrity, and availability.
OpenIdentityPlatform OpenAM versions prior to 16.0.6 contain a critical deserialization vulnerability (CWE-502) that allows unauthenticated remote code execution. The flaw arises from unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing previous mitigations applied to a similar parameter. An attacker can exploit this by sending a crafted serialized Java object to specific endpoints using JATO ViewBean JSPs, such as password reset pages. This vulnerability is fixed in version 16.0.6.
CVE-2026-39324 is a critical improper authentication vulnerability in rack-session versions 2.0.0 up to but not including 2.1.2. The vulnerability arises because Rack::Session::Cookie incorrectly handles decryption failures by falling back to a default decoder instead of rejecting the cookie. This flaw allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid without knowing any configured secret, enabling manipulation of session contents and potential unauthorized access. The issue is fixed in version 2.1.2.
NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to arbitrary code execution.
Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.
A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
Kedro versions prior to 1.3.0 contain a critical remote code execution vulnerability due to unsafe loading of a logging configuration file specified by the KEDRO_LOGGING_CONFIG environment variable. The logging configuration supports a special key that allows arbitrary callable instantiation, enabling attackers to execute system commands during application startup. This vulnerability is fixed in Kedro version 1.3.0.
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.