Security Intel Hub 561— Search: `反序列化`×

Curated security advisories, vulnerability analyses, and exploit write-ups — auto-cleaned and translated to English. Updated continuously.

Filter

KEV only

Verified PoC

CVSS 6.4

newsletters-lite plugin vulnerability fixes (CVE-2024-12038/12039) and patches

plugins.trac.wordpress.org · 2026-07-29

### Vulnerability Overview The provided webpage screenshot highlights several security vulnerabilities in the `newsletters-lite` plugin, including Cross-Site Scripting (XSS) vulnerabilities, unauthori…

CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage-Apache Mail Archives

lists.apache.org · 2026-08-06

### Vulnerability Overview - **CVE ID**: CVE-2026-66909 - **Vulnerability Name**: Apache CXF: Unsafe Deserialization of Inbound JMS ObjectMessage - **Severity**: Important - **Description**: The JMS t…

CVSS 6.5

jackson-databind: @JsonIgnore Bypass on Records via PropertyNamingStrategy

github.com · 2026-07-15

### Vulnerability Overview This vulnerability involves an issue where the `@JsonIgnore` annotation is ignored when `PropertyNamingStrategy` is used within the `Record` class. Specifically, when `@Json…

「幻核-2」你的终端在"叛变" ANSI 转义序列注入攻击-先知社区

xz.aliyun.com · 2026-05-18

### Vulnerability Overview - **Vulnerability Name**: "Phantom Core-2" Your Terminal is "Rebeling" - ANSI Escape Sequence Injection Attack - **Vulnerability Description**: In 1978, DEC released the VT1…

GitHub - USCiLab/cereal: A C++11 library for serialization · GitHub

github.com · 2026-06-13

### Vulnerability Overview The webpage screenshot displays the GitHub repository for "cereal," a C++11 serialization library. The page mentions a vulnerability (#848) related to the fix for `std::arra…

CVSS 6.5

IBM Cloud Pak for Business Automation Security Bulletin: Multiple CVEs including Container Escape and RCE

www.ibm.com · 2025-05-05

### Critical Vulnerability Information #### Vulnerability Overview - **Announcement**: This security announcement addresses multiple security vulnerabilities in IBM Cloud Pak for Business Automation v…

Premium intel

CVSS 9.8KEV

SolarWinds Web Help Desk Multiple High-Severity Vulnerabilities (RCE, Auth Bypass, Hardcoded Credentials)

documentation.solarwinds.com · 2026-01-28

### Critical Vulnerability Information #### Fixed CVEs | CVE-ID | Vulnerability Title | Description | Severity | Discoverer | | --- | --- | --- | --- | --- | | CVE-2025-4056 | SolarWinds Web Help Desk…

Premium intel

CVSS 9.8

llama.cpp RPC RCE Patch: Fix in deserialize_tensor_info

github.com · 2026-04-02

### 漏洞修复总结 **漏洞概述** 该提交记录展示了 `llama.cpp` 项目（一个基于 C++ 的 Llama 模型推理库）中一个关键的安全修复。提交信息明确标注为 `rpc : RCE patch (#20980)`，表明该补丁修复了 RPC 模块中存在的远程代码执行（RCE）漏洞，有效防止攻击者通过构造恶意数据实现远程代码执行。 **影响范围** - **仓库**: `ngml/ll…

Premium intel

CVSS 6.1

Roundcube Webmail 1.6.14 Security Update: Fixes Arbitrary File Write, IMAP Injection, XSS

github.com · 2026-04-03

# Roundcube Webmail 1.6.14 安全更新总结 ### 漏洞概述 Roundcube Webmail 1.6.14 版本发布，这是一个安全更新，旨在修复近期报告的多个严重安全漏洞。 ### 漏洞详情本次更新修复了以下具体漏洞： * **任意文件写入**：Redis rememberme 会话处理程序中存在不安全的反序列化漏洞（由 PiyushGPTY 报告）。 * **密码重…

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE · Advisory ·

github.com · 2026-05-07

# Vulnerability Summary: Deserialization RCE Vulnerability in fabric-sdk-java ## Vulnerability Overview A deserialization Remote Code Execution (RCE) vulnerability exists in the Java client SDK (`fabr…

CVE-2026-31224 | Notion

www.notion.so · 2026-05-22

# CVE-2026-31224 Vulnerability Summary ## Overview - **Vulnerability Name**: CVE-2026-31224 — Unsafe `torch.load` in Snorkel `MultitaskClassifier.load` - **Vulnerability Type**: Insecure Deserializati…

api.php in forms-rb/tags/1.1.9/app – WordPress Plugin Repository

plugins.trac.wordpress.org · 2026-05-22

# Vulnerability Summary ## Overview The webpage screenshot displays an API code file (`app/api.php`) from the WordPress plugin "forms-rb". The code contains an **Insecure Deserialization** vulnerabili…

Full Page Cache Warmer for Magento 2 — What's New - Mirasvit Magento Extensions

mirasvit.com · 2026-05-26

### Vulnerability Overview The vulnerability mentioned in the webpage screenshot is a **PHP Object Injection security vulnerability** that occurs during the **session cookie deserialization** process.…

Jenkins Plugin Security Advisory: RCE, SSRF, AFR, Path Traversal via CVEs

www.jenkins.io · 2026-05-28

### Jenkins Security Advisory 2026-05-27 #### Vulnerability Summary 1. **RCE via Unvalidated LDAP Redirect in LDAP Plugin** - **CVE**: CVE-2026-48916 (SSRF), CVE-2026-48917 (Deserialization) - **Sever…

Jenkins Plugin Security Bulletin: RCE, SSRF, LFI via LDAP/AD/Credentials

www.jenkins.io · 2026-05-28

### Jenkins Security Advisory 2026-05-27 #### Vulnerability Overview This advisory announces vulnerabilities in the following Jenkins components: - Active Directory Plugin - AppSpider Plugin - Bitbuck…

Jenkins Security Advisory: RCE and Path Traversal in Multiple Plugins (CVE-2026-48916-48925)

www.jenkins.io · 2026-05-28

### Jenkins Security Advisory 2026-05-27 #### Vulnerability Overview This advisory announces vulnerabilities in the following Jenkins components: 1. **Remote Code Execution (RCE) Vulnerability in LDAP…

Jenkins Plugin Advisory: LDAP Redirection Leads to RCE via Deserialization

www.jenkins.io · 2026-05-28

### Jenkins Security Advisory 2026-05-27 #### Vulnerability Overview This advisory announces vulnerabilities in the following Jenkins artifacts: - Active Directory Plugin - AppSpider Plugin - Bitbucke…

Jenkins Security Bulletin: Multiple Plugin Vulnerabilities including RCE, AFR, CSRF

www.jenkins.io · 2026-05-28

### Jenkins Security Advisory 2026-05-27 Vulnerability Summary #### Vulnerability Overview 1. **RCE vulnerability due to unvalidated LDAP redirection in the LDAP Plugin** - **CVE**: CVE-2026-48916 (SS…

Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection | Advisories | Vul

www.vulncheck.com · 2026-06-13

### Vulnerability Overview A vulnerability exists in Ghidra versions prior to 12.1 involving unfiltered RMI deserialization. Attackers can exploit this by crafting a malicious shared project connectio…

CVSS 5.3

Jackson Databind @JsonIgnore Bypass Vulnerability Analysis

github.com · 2026-06-27

### Vulnerability Overview This vulnerability involves bypassing setter methods annotated with `@JsonIgnore` via private fields during deserialization, leading to potential security issues. Specifical…

All articles are auto-cleaned (markdown extraction + LLM noise removal) and translated to English by our offline pipeline. Source URL is always preserved at the bottom of each article.

Want a specific source covered? Email us — we add new feeds weekly.

Goal Reached Thanks to every supporter — we hit 100%!

Security Intel Hub 561— Search: 反序列化×

Security Intel Hub 561— Search: `反序列化`×