Search Vulnerabilities

Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML

Grav before 2.0.9 Remote Code Execution via FlexDirectory

DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

Kirby: Arbitrary Method Call via REST API search and collection query endpoints

Yamcs: Remote Code Execution via Mission Database algorithm override

PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter

Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources

IBM WebSphere eXtreme Scale's OQL is affected by remote code execution

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction

Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution

CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute