Base de CVEs

CVE-2026-54071 Alta · 7.8 CWE-502 21/08/2026

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.

CVE-2026-77646 Alta · 7.7 CWE-502 20/08/2026

Server Side Request Forgery (SSRF) vulnerability reported in Windchill

A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

CVE-2026-69836 Crítica · 10.0 CWE-502 20/08/2026

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

CVE-2026-18285 Alta · 7.8 CWE-502 20/08/2026

Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability

Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the load_rehab_pile_dataset method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28749.

CVE-2026-15679 Alta · 7.8 CWE-502 20/08/2026

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.

CVE-2026-73993 Crítica · 9.8 CWE-502 20/08/2026

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

CVE-2026-66672 Crítica · 9.8 CWE-502 20/08/2026

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

CVE-2026-66583 Crítica · 9.8 CWE-502 20/08/2026

WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

CVE-2026-76850 Crítica · 9.8 CWE-502 19/08/2026

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.

CVE-2026-76404 Crítica · 9.1 CWE-502 19/08/2026

Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

CVE-2026-76395 Alta · 8.8 CWE-502 19/08/2026

Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Troubleshoot the Splunk Machine Learning Toolkit (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/machine-learning-toolkit-user-guide/5.5.0/troubleshooting-mltk/troubleshoot-the-splunk-machine-learning-toolkit) in the Splunk documentation.

CVE-2026-44901 Alta · 8.4 CWE-502 19/08/2026

Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.

CVE-2026-49817 Alta · 7.8 CWE-502 19/08/2026

Deserialization of Untrusted Data em Dell Command Update

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVE-2026-49816 Alta · 7.8 CWE-502 19/08/2026

Deserialization of Untrusted Data em Dell Command Update

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVE-2026-73389 Crítica · 9.8 CWE-502 19/08/2026

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

CVE-2026-73364 Crítica · 9.8 CWE-502 19/08/2026

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

CVE-2026-60412 Alta · 7.8 CWE-502 18/08/2026

Deserialization of Untrusted Data em Oracle Outside In Technology

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVE-2026-60392 Alta · 7.8 CWE-502 18/08/2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component:...

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVE-2026-74012 Alta · 8.8 CWE-502 18/08/2026

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.

CVE-2026-73397 Crítica · 9.8 CWE-502 18/08/2026

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

CVE-2026-73380 Crítica · 9.8 CWE-502 18/08/2026

WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

CVE-2026-73376 Crítica · 9.8 CWE-502 18/08/2026

WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

CVE-2026-73366 Crítica · 9.8 CWE-502 18/08/2026

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

CVE-2026-73341 Crítica · 9.8 CWE-502 18/08/2026

WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

CVE-2026-66620 Alta · 7.2 CWE-502 18/08/2026

WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.