Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Security Intel Hub 555— Search: 反序列化×

Curated security advisories, vulnerability analyses, and exploit write-ups — auto-cleaned and translated to English. Updated continuously.

Clear
Examples: RCE · SSRF · GHSA · log4j
Filter
Premium intel
CVSS 8.4
WatchGuard Fireware Insecure Deserialization in Access Portal (CVE-2026-4266)
www.watchguard.com · 2026-04-02

### Vulnerability Key Information Summary **Vulnerability Overview** * **Name**: WatchGuard Firebox Insecure Deserialization in Fireware Access Portal * **CVE ID**: CVE-2026-4266 * **Description**: An…

Read more
CVSS 8.8
NVIDIA BioNeMo Framework Deserialization Vulnerability Advisory (CVE-2026-24164/165)
nvidia.custhelp.com · 2026-04-02

## NVIDIA BioNeMo Framework Security Bulletin - March 2026 ### Vulnerability Overview | CVE ID | Description | Vector | CVSS Score | Severity | CWE | Impact | |--------|------|------|-----------|-----…

Read more
CVSS 8.8
NVIDIA BioNeMo Deserialization Vulnerability CVE-2026-24164 Analysis
nvd.nist.gov · 2026-04-02

# CVE-2026-24164 Vulnerability Summary ## Vulnerability Overview | Attribute | Content | |:---|:---| | **CVE ID** | CVE-2026-24164 | | **Status** | AWAITING ANALYSIS | | **Vulnerability Type** | Deser…

Read more
Premium intel
CVSS 10.0
Authenticated RCE via PHP Insecure Deserialization in Intermezz/groupoffice
github.com · 2026-04-03

### Vulnerability Summary - **Summary/Description**: This is a remote code execution (RCE) vulnerability caused by insecure PHP deserialization. An authenticated user can execute arbitrary system comm…

Read more
Premium intel
CVSS 6.1
Roundcube Webmail 1.5.14 Security Update: Pre-Auth File Write via Deserialization, IMAP Injection, XSS
github.com · 2026-04-03

### Roundcube Webmail 1.5.14 安全更新总结 **漏洞概述** Roundcube Webmail 1.5.14 版本发布，修复了多个严重安全漏洞，包括： - **任意文件写入**：通过 Redis/Memcache 会话处理器中的不安全反序列化，可在未认证状态下写入任意文件。 - **密码修改绕过**：修复了无需提供旧密码即可更改密码的缺陷。 - **IMAP 注入 /…

Read more
Premium intel
CVSS 6.1
Roundcube Webmail Security Update: SSRF, XSS, Deserialization Fixes
roundcube.net · 2026-04-03

### 漏洞概述 Roundcube Webmail 发布安全更新（版本 1.7-rc5、1.6.14 和 1.5.14），修复了多个近期报告的安全漏洞。 ### 影响范围 - Roundcube Webmail 1.6 和 1.5 LTS 版本 - Roundcube Webmail 1.7 的候选版本（1.7-rc5） ### 修复方案 建议立即升级至以下版本以修复所有已知漏洞： - **1.…

Read more
CVSS 4.5
cfs-GroundSystem pickle.load() Arbitrary Code Execution Vulnerability
github.com · 2026-04-04

## [SECURITY] pickle.load() arbitrary code execution in cfs-GroundSystem #551 **Status:** Open (Unresolved) ### Overview A critical security vulnerability exists in the `cfs-GroundSystem` project due …

Read more
CVSS 7.3
FedML-AI FedML Deserialization Vulnerability (CVE-2026-5536) Advisory
vuldb.com · 2026-04-05

# CVE-2026-5536 Vulnerability Summary ## Vulnerability Overview | Attribute | Content | |:---|:---| | **CVE ID** | CVE-2026-5536 | | **Vulnerability Type** | Deserialization | | **Severity** | **Criti…

Read more
CVSS 7.3
FedML gRPC Pickle Deserialization RCE Vulnerability
github.com · 2026-04-05

## Vulnerability Overview **Vulnerability Name**: Remote Code Execution via gRPC Pickle Deserialization in FedML **Vulnerability Type**: Remote Code Execution (RCE) **Root Cause**: Insecure deserializ…

Read more
phpBB 3.2.3 Phar Deserialization RCE Exploit (EDB-ID: 46512)
www.exploit-db.com · 2026-04-06

### Vulnerability Summary **Vulnerability Overview** * **Vulnerability Name**: phpBB 3.2.3 - Remote Code Execution (RCE) * **EDB-ID**: 46512 * **CVE ID**: N/A * **Author**: ALLYSHKА * **Type**: WEBAPP…

Read more
CVSS 6.3
pytries datrie Unsafe Deserialization Vulnerability (RCE)
vuldb.com · 2026-04-06

### Vulnerability Summary: pytries datrie Deserialization Vulnerability **Vulnerability Overview** This vulnerability exists within the `pytries datrie` library. The `datrie.Trie` class uses the unsaf…

Read more
CVSS 6.3
datrie Arbitrary Code Execution via Insecure Deserialization with POC
github.com · 2026-04-06

## Vulnerability Overview **Vulnerability Name**: Arbitrary Code Execution via Insecure Deserialization in datrie.Trie (#109) **Description**: The `datrie.Trie` class contains a vulnerability when des…

Read more
CVSS 6.3
datrie Trie Arbitrary Code Execution via Unsafe Pickle Deserialization
github.com · 2026-04-06

# Vulnerability Summary: datrie.Trie Arbitrary Code Execution ## 1. Vulnerability Overview The `Trie` class within the `datrie` library utilizes the unsafe `pickle.load()` method to deserialize intern…

Read more
Unsafe Deserialization in Erlang hex_core/rebar3 (CVE-2026-21619)
cna.erlef.org · 2026-04-07

### Vulnerability Overview * **CVE ID**: CVE-2026-21619 * **Vulnerability Name**: Unsafe Deserialization of Erlang Terms in hex_core * **CVSS Score**: 2.0 (Low) * **Vulnerability Type**: Uncontrolled …

Read more
Erlang Hex/Rebar3 Unsafe Deserialization Vulnerability (CVE-2026-21619) Advisory
osv.dev · 2026-04-07

### Vulnerability Key Information Summary **1. Vulnerability Overview** * **Vulnerability ID:** `EEF-CVE-2026-21619` (Alias: `CVE-2026-21619`, `GHSA-hx9w-j2w9-9y98`) * **Vulnerability Type:** Unsafe D…

Read more
HuggingFace Transformers Trainer Arbitrary Code Execution via Unsafe torch.load (CVE-2026-1839)
huntr.com · 2026-04-07

### Vulnerability Key Information Summary **1. Vulnerability Overview** * **Vulnerability Name:** Arbitrary Code Execution via Unsafe `torch.load()` in Trainer Checkpoint Loading in huggingface/transf…

Read more
SGLang Pickle Deserialization RCE (CVE-2026-3989/3990) and Fix Analysis
github.com · 2026-04-08

### Vulnerability Overview The SGLang project contains a critical security vulnerability (CVSS 9.8) stemming from deserialization operations performed by the `pickle.loads()` and `recv_pyobj()` functi…

Read more
OpenAM Deserialization Bypass of CVE-2021-35464 Leading to RCE
github.com · 2026-04-08

### Vulnerability Summary: OpenAM Deserialization Remote Code Execution **Vulnerability Overview** OpenAM 16.0.5 (and earlier versions) contains a deserialization vulnerability (a variant/bypass of CV…

Read more
CVSS 7.1
Red Hat Quay CVE-2026-32590 Pickle Deserialization RCE
bugzilla.redhat.com · 2026-04-09

### Vulnerability Key Information Summary **1. Vulnerability Overview** * **CVE ID:** CVE-2026-32590 * **Vulnerability Name:** mirror-registry: remote code execution via pickle deserialization (Mirror…

Read more
Premium intel
CVSS 9.8
praisonal CVE-2025-39890 YAML Deserialization RCE Vulnerability and PoC
github.com · 2026-04-09

### Vulnerability Summary **Vulnerability Overview** The vulnerability exists in the `AgentService.loadAgentFromFile` method within the `praisonal` package. This method uses the `js-yaml` library to p…

Read more

All articles are auto-cleaned (markdown extraction + LLM noise removal) and translated to English by our offline pipeline. Source URL is always preserved at the bottom of each article.

Want a specific source covered? Email us — we add new feeds weekly.