Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/extension/impl modules). This vulnerability is associated with program files XmlFile.Java.
This issue affects tis: before v4.3.0.
Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.
The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
Strongly consider upgrading to the latest package versions to reduce risk and prevent availability issues in applications using React Server Components.
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.
The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.
It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.
NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.
This issue affects Apache Karaf Decanter before 2.12.0.
Users are recommended to upgrade to version 2.12.0, which fixes the issue.
CVE-2025-15351 is a high-severity remote code execution vulnerability in Anritsu VectorStar version 2024.11.1, caused by deserialization of untrusted data during CHX file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, allowing attackers to execute arbitrary code with the privileges of the current process. The vulnerability stems from improper validation of user-supplied data, enabling attackers to manipulate deserialization logic. Although no known exploits are currently in the wild, the impact on confidentiality, integrity, and availability is high. European organizations using VectorStar in critical infrastructure or research environments are at risk. Mitigation involves restricting file sources, applying strict input validation, and isolating the application environment. Countries with significant telecommunications, aerospace, and research sectors using Anritsu products, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-15350 is a high-severity remote code execution vulnerability in Anritsu VectorStar version 2024.11.1. It arises from improper validation during the parsing of CHX files, leading to deserialization of untrusted data. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage. Successful exploitation allows attackers to execute arbitrary code with the privileges of the current process, impacting confidentiality, integrity, and availability. No known exploits are currently in the wild. The vulnerability is rated with a CVSS score of 7.8, reflecting its significant risk. European organizations using Anritsu VectorStar, particularly in telecommunications and electronics testing sectors, should prioritize patching and implement strict file handling policies.
CVE-2025-15348 is a high-severity remote code execution vulnerability in Anritsu ShockLine version 2025.4.2. It arises from insecure deserialization of untrusted data during the parsing of CHX files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. Successful exploitation allows attackers to execute arbitrary code with the privileges of the current process, impacting confidentiality, integrity, and availability. No known exploits are currently in the wild. The vulnerability is particularly relevant for organizations using Anritsu ShockLine for network testing and diagnostics. European organizations relying on this product should prioritize patching and implement strict file handling policies. Countries with significant telecom infrastructure and industrial sectors using Anritsu products are at higher risk.
CVE-2026-0760 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It arises from improper validation during deserialization of untrusted data in the deserialize_message function, allowing attackers to execute arbitrary code without authentication or user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 9.8. Exploitation occurs remotely and requires no privileges, making it highly dangerous. Although no known exploits are currently in the wild, the flaw poses a significant risk to affected systems. European organizations using MetaGPT 0.8.
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.
CVE-2026-23737 is a high-severity deserialization vulnerability in the lxsmnsyc seroval library versions below 1.4.1. The flaw exists in the fromJSON and fromCrossJSON functions, which improperly handle untrusted input during JSON deserialization, enabling arbitrary JavaScript code execution. Exploitation requires an attacker to perform multiple requests with partial knowledge of serialized data usage, without user interaction but with low privileges. This vulnerability can compromise confidentiality, integrity, and availability of affected systems. Although no known exploits are reported in the wild, the risk is significant due to the potential for remote code execution. The issue is fixed in version 1.4.1.
CVE-2026-23524 is a critical deserialization vulnerability in Laravel Reverb versions below 1.7.0 that allows unauthenticated remote code execution. The flaw arises because data from Redis channels is passed directly into PHP's unserialize() function without class restrictions, enabling attackers to instantiate malicious objects. Exploitation is facilitated by the common practice of deploying Redis without authentication and occurs only when horizontal scaling is enabled (REVERB_SCALING_ENABLED=true). The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 9.8. Mitigation includes upgrading to Laravel Reverb 1.7.0 or later, enforcing strong Redis authentication, restricting Redis access to private networks, or disabling horizontal scaling if feasible.
The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untrusted input in the 'nxt_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques. This can lead to disclosure of sensitive installation and service-account data and compromise of the affected host.
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.
CVE-2025-69276 is a deserialization of untrusted data vulnerability in Broadcom DX NetOps Spectrum versions 24.3.13 and earlier on Windows and Linux platforms. This vulnerability allows object injection, potentially enabling an attacker to manipulate application behavior or cause denial of service. The CVSS 4.0 base score is 2.3, indicating low severity due to high attack complexity and limited impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. European organizations using DX NetOps Spectrum for network monitoring should assess their exposure and plan updates. Mitigation primarily involves upgrading to a fixed version once available or applying vendor-recommended workarounds.
Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7.
