Security Intel Hub 553— Search: 反序列化×

TCL 10.0 Insufficient Validation of Serialized Session Data Leading to Memory Safety Issues (CVE-2026-34877)

Based on the provided information, here is the vulnerability intelligence summary extracted and summarized in concise English Markdown format: **1. Vulnerability Overview** * **Title:** Risk of insuff…

Roundcube Redis/RedisCache Session Handler Unsafe Deserialization Arbitrary File Write Fix

### Vulnerability Summary **Vulnerability Overview** A security vulnerability related to unsafe deserialization has been fixed in the Redis/RedisCache session handler of Roundcube email client. The fl…

# Vulnerability Summary ## Overview **Vulnerability Name**: Apache ActiveMQ Remote Code Execution Vulnerability (CVE-2023-46604) **Vulnerability Type**: Remote Code Execution (RCE) **Description**: Th…

PyOD unpickle RCE: load() executes joblib.load before envelope validation

### Vulnerability Overview **Title**: Security: persistence.load unpickles artifacts before envelope validation #697 **Description**: `pyod.utils.persistence.load()` executes `joblib.load(path)` befor…

NASA cFS Ground System Deserialization RCE via Pickle

# NASA cFS 7.0.0 Code Execution Vulnerability Summary ### Vulnerability Overview * **Vulnerability Type**: Deserialization Vulnerability / Arbitrary Code Execution * **Affected Component**: NASA cFS G…

Modular Max: Fix RCE risk by removing default Pickle serialization in Zmq Sockets

### Key Information Summary #### Vulnerability Description This commit `ee9c4ab` primarily addresses serialization issues in Zmq Sockets, covering the following aspects: 1. **Removal of Default Pickle…

jsonpickle documentation

### jsonpickle Vulnerability Summary #### Vulnerability Overview The jsonpickle module contains security risks when processing data. This module allows users to serialize arbitrary Python objects into…

Restrict exception-node deserialization to known classes without importing the stored name by potiuk · Pull Request #685

### Vulnerability Overview This vulnerability involves the deserialization of exception nodes in Apache Airflow. When deserializing `AIRFLOW_ENC_SER` and `BASE_ENC_SER` nodes, the exception classes ar…

GPT-SoVITS Multiple Deserialization RCE Vulnerabilities (CVE-2025-49837 to 49841)

### Critical Vulnerability Information #### Vulnerability IDs - GHSL-2025-049 - GHSL-2025-053 #### Vulnerability Type - Remote Code Execution (RCE) #### Affected Component - GPT-SoVITS #### Related CV…

jackson-databind @JsonIgnore Skips Setterless Creator Properties Deserialization

### Vulnerability Overview This vulnerability involves certain "setterless" creator properties (i.e., properties without setter methods) being skipped during deserialization when their corresponding s…

antlr4_003_Unsafe_Java_Deserialization_Maven_Plugin · Issue #7 · wooyun123/wooyun

### Vulnerability Overview **CVE Report: Insecure Java Object Deserialization (Missing Class Filter) in ANTLR4 Maven Plugin** - **Project**: ANTLR4 Maven Plugin - **Repository**: [https://github.com/a…

GitHub - jsonpickle/jsonpickle: Python library for serializing any arbitrary object graph into JSON. It can take almost

### jsonpickle Vulnerability Summary #### Overview jsonpickle is a library used to serialize Python objects into JSON format. However, this library contains a critical security vulnerability that allo…

From SQLi to RCE - Exploiting LangGraph’s Checkpointer - Check Point Research

### Vulnerability Overview LangGraph is an open-source framework for building multi-agent AI systems with built-in persistence. The LangGraph persistence layer (Checkpointer) contains two critical vul…

systemd CVE-2018-15686: Serialization/Deserialization Vulnerability Fix Analysis

## Vulnerability Key Information - **CVE ID**: CVE-2018-15686 - **Vulnerability Description**: - This Pull Request (PR) introduced an alert indicating a comparison result is always the same, affecting…

Apache Airflow Deserialization RCE via unrestricted import_string (CVE-2026-33264)

### Vulnerability Overview CVE-2026-33264: Remote Code Execution (RCE) vulnerability in Apache Airflow's DAG authors via `unrestricted import_string()` within `BaseSerialization.deserialize()`. ### Im…