Apache XML Graphics FOP unsafe deserialization in hyphenation loading (CVE-2026-71395)
Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.
Stories per day · 30 days
7 RSS
Relatedremote-code-execution41meta37fairchem26zero-day22zdi20rce11detectron26java6airflow4apache4apache-camel4fairseq4scheduler4denial-of-service3microsoft3mlflow3qlib3apache-kylin2
72 stories, newest first · one card per story
Stories tagged #deserialization
Meta FAIRChem NPZ parser allows RCE via untrusted data (ZDI-26-946)
ZDI rates the unpatched FAIRChem flaw 7.8; a user must open a malicious file or visit a malicious page.
Meta Detectron2 checkpoint loading can run code (ZDI-26-912)
Untrusted deserialization in detection_checkpoint is unpatched; ZDI rates it CVSS 7.8.
Meta fairseq load_checkpoint_to_cpu allows RCE (ZDI-26-943)
ZDI scores the unpatched deserialization bug 7.8 and says a malicious file or page is required.
DataSketches Java through 9.0.0 can exhaust memory on crafted input
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
NVIDIA Megatron-LM checkpoint flaw allows code execution
Opening a malicious checkpoint file is required; ZDI rates CVE-2026-65110 at CVSS 7.8.
Apache Airflow scheduler deserializes task-controlled XCom values (CVE-2026-86829)
Dag authors control XCom values that the scheduler fully deserializes during dependency evaluation.
Apache Storm Client vulnerability allows deserialization of untrusted state store data
Apache Storm Client before 3.1.0 deserializes untrusted data from state store with disabled Kryo class registration, enabling arbitrary code execution.
Apache Axis 1.x unauthenticated remote class instantiation via SOAP (CVE-2026-90436)
Deserialization of inbound SOAP faults in Apache Axis 1.x allows unauthenticated remote class instantiation; unsupported as end-of-life.
Quest Foglight for Databases Deserialization Flaw Enables Remote Code Execution
Unauthenticated remote attackers can execute arbitrary code in Quest Foglight for Databases via a deserialization vulnerability (CVE-2026-92190).
Apache Struts2 JSON Plugin Object Deserialization Limit Bypass
Bypass targets element-count limit in object deserialization for versions 7.4.0 and 7.5.0 snapshot.
Microsoft Qlib RestrictedUnpickler Deserialization Vulnerability Allows Remote Code Execution
ZDI-26-849 reports a remote code execution vulnerability in Microsoft Qlib that requires user interaction to exploit.
Apache MINA 3.0.0 through 3.0.0-M2 unsafe deserialization (CVE-2026-118636)
JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.
MLflow SHAP load_explainer bug allows RCE (CVE-2026-118627)
ZDI rates the deserialization flaw 7.8 and says the victim must open a malicious page or file.
Apache Struts2 JSON plugin insecure deserialization report continues
Daniel Owens cites earlier Struts2 JSON denial-of-service write-ups and a naïve proof-of-concept script; this excerpt ends before new details.
Kafka deserializers can exhaust memory from a size field (CVE-2026-111551)
Apache calls the flaw important: a small input can declare a huge size and force a large allocation.
Ultralytics torch_load untrusted deserialization leads to remote code execution
ZDI-26-812 scores 7.8 and needs a user to open a malicious file or visit a malicious page.
Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
1
JANUS synthesizes cross-layer defenses for deserialization attacks
On 16 Java and PHP deployments, held-out attack success fell to 6.2% while 98.4% of benign tests still passed.
Apache Camel flaws allow remote code execution and data theft
Eight critical and high issues span Camel K and Camel components, with fixes that differ by branch.
1
Meta FAIRChem adsorbate_db_path flaw allows code execution
ZDI rates the reaction adsorbate_db_path deserialization bug 7.8 and requires user interaction.
Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution
Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.
AI-agent campaign breached websites at more than 100 companies
NorForge tracked campaign AIA0001 across 14 dashboards; Deere, SharkNinja and Cummins were named.
5
Apache Camel JGroups deserializes cluster messages to RCE
CVE-2026-88900 scores CVSS 8.8; fixed builds are 4.18.5 and 4.22.1.