Total
2960 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-71376 | 2026-06-23 | N/A | 8.1 HIGH | ||
| picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims. | |||||
| CVE-2025-71339 | 2026-06-23 | N/A | 8.1 HIGH | ||
| Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation. | |||||
| CVE-2025-71365 | 2026-06-23 | N/A | 8.1 HIGH | ||
| picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded. | |||||
| CVE-2025-71341 | 2026-06-23 | N/A | 8.1 HIGH | ||
| picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded. | |||||
| CVE-2025-71358 | 2026-06-23 | N/A | 8.1 HIGH | ||
| picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load(). | |||||
| CVE-2025-71370 | 2026-06-23 | N/A | 8.1 HIGH | ||
| picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load(). | |||||
| CVE-2026-41957 | 1 F5 | 22 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 19 more | 2026-06-23 | N/A | 8.8 HIGH |
| An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-53874 | 2026-06-23 | N/A | 9.8 CRITICAL | ||
| picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources. | |||||
| CVE-2026-48909 | 2026-06-22 | N/A | N/A | ||
| SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server. | |||||
| CVE-2022-29528 | 1 Misp-project | 1 Misp | 2026-06-22 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. | |||||
| CVE-2019-12868 | 1 Misp-project | 1 Misp | 2026-06-22 | 6.5 MEDIUM | 7.2 HIGH |
| app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization. | |||||
| CVE-2026-12787 | 2026-06-22 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-49286 | 2026-06-22 | N/A | 8.1 HIGH | ||
| PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (which the library still supports — PHP 7.4+), this triggers deserialization of a crafted PHAR archive's metadata, leading to remote code execution. This is the patch-bypass of CVE-2023-28115. The same issue and fix were handled upstream in KnpLabs/snappy (GHSA-92rv-4j2h-8mjj). PhpWeasyPrint version 2.6.0 contains a patch for the issue. | |||||
| CVE-2026-8024 | 2026-06-22 | N/A | 9.8 CRITICAL | ||
| A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems. | |||||
| CVE-2026-35300 | 1 Oracle | 1 Weblogic Server | 2026-06-18 | N/A | 9.8 CRITICAL |
| Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2025-71321 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution. | |||||
| CVE-2026-54806 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |||||
| CVE-2026-52706 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |||||
| CVE-2026-49107 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |||||
| CVE-2026-40757 | 2026-06-17 | N/A | 8.1 HIGH | ||
| Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | |||||