Все уязвимости

Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow: Arbitrary import in custom deadline-reference deserialization

Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API

Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

Microsoft SQL Server Remote Code Execution Vulnerability

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction...

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections...

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to...

jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization

Microsoft M365 Copilot Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

.NET Remote Code Execution Vulnerability