#deserialization
LightNews LightNews
d-m.bsky.social
I dread a generation of gamers who will never know the special feeling of playing a game with a handwritten unit test framework.

Millions will grow up without knowing the warmth of human-authored XML deserialization routines.
November 10, 2026 at 8:11 AM
digi.ninja
Happy Friday everyone. To celebrate the end of the week I've just published a new set of labs for anyone interested in learning about deserialization attacks.

To start with I've got PHP, Python Flask and Node.js Express web apps:

github.com/digininja/ce...
November 6, 2026 at 1:29 PM
aur.archlinux.org.web.brid.gy
python-smithy-cbor
CBOR serialization and deserialization support for Smithy tooling.
aur.archlinux.org
November 9, 2026 at 8:04 PM
iagox86.bsky.social
Nice! I've been wanting to do something like that, deserialization is something I've never really gotten the hang of
November 6, 2026 at 2:48 PM
vulnsea.com
🌊 ABYSSAL · critical with a public exploit
CVE-2026-118623: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVSS 7.8 · EPSS 0.4% · 0day
https://vulnsea.com/cve/CVE-2026-118623

#CVE #infosec #cybersecurity #threatintel
CVE-2026-118623 — MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required…
vulnsea.com
November 6, 2026 at 5:29 AM
skillthropic.com
Injection, Broken Access Control, Deserialization, TOCTOU: The Four Flaw Families and the Coding Rules That Kill Them

CISSP Domain 8 does not ask you to write code.

www.skillthropic.com/blog/secure-...

#CISSP #infosec #cybersecurity
November 6, 2026 at 8:45 PM
vulnsea.com
🌊 ABYSSAL · critical with a public exploit
CVE-2026-118627: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVSS 7.8 · EPSS 0.2% · 0day
https://vulnsea.com/cve/CVE-2026-118627

#CVE #infosec #cybersecurity #threatintel
CVE-2026-118627 — MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to e…
vulnsea.com
November 6, 2026 at 6:29 AM
infosec.skyfleet.blue
CVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
oss-sec: CVE-2026-82337: Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
Posted by Rahul Vats on Nov 08 Severity: moderate Affected versions: - Apache Airflow before 3.4.0 Description: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list to be constructed in those processes with arguments they control. Deployments whose Dags use...
seclists.org
November 9, 2026 at 7:33 AM
infosec.skyfleet.blue
CVE-2026-82436: Apache Storm Client: Deserialization of Untrusted Data from the State Store
oss-sec: CVE-2026-82436: Apache Storm Client: Deserialization of Untrusted Data from the State Store
Posted by Richard Zowalla on Nov 08 Severity: important Affected versions: - Apache Storm Client (org.apache.storm:storm-client) 3.0.0 before 3.1.0 Description: Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party able to write to...
seclists.org
November 9, 2026 at 5:42 AM
cve.skyfleet.blue
CVE-2026-116499 - Arbitrary Code Execution in Qiskit SDK QPY Deserialization
CVE ID : CVE-2026-116499

Published : Nov. 8, 2026, 5:03 p.m. | 15 minutes ago

Description : IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deser...
CVE-2026-116499 - Arbitrary Code Execution in Qiskit SDK QPY Deserialization
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
cvefeed.io
November 8, 2026 at 5:37 PM
particular.net
System.Text.Json polymorphic deserialization
System.Text.Json Polymorphic Deserialization | Maarten Balliauw {blog}
Deserialize JSON into derived or abstract types: $type discriminators, [JsonPolymorphic] in .NET 7+, and a custom JsonConverter for legacy payloads.
blog.maartenballiauw.be
November 6, 2026 at 1:09 PM
cve.skyfleet.blue
CVE-2026-116500 - Unbound Recursion in QPY deserialization can lead to denial of service
CVE ID : CVE-2026-116500

Published : Nov. 8, 2026, 5:04 p.m. | 14 minutes ago

Description : IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of servi...
CVE-2026-116500 - Unbound Recursion in QPY deserialization can lead to denial of service
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads.
cvefeed.io
November 8, 2026 at 5:43 PM
cve.skyfleet.blue
CVE-2026-125704 - Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
CVE ID : CVE-2026-125704

Published : Nov. 10, 2026, 10:43 a.m. | 43 minutes ago

Description : A use-after-free flaw was found in GStreamer core buffer value deserializat...
CVE-2026-125704 - Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. An application that parses untrusted caps or structure data could crash; a network-facing GStreamer Data Protocol receiver can process such …
cvefeed.io
November 10, 2026 at 11:47 AM
thehackerwire.bsky.social
🔴 CVE-2026-119516 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Cale...

https://www.thehackerwire.com/vulnerability/CVE-2026-119516/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
CVE-2026-119516 - Critical
November 6, 2026 at 8:33 AM
offseq.bsky.social
Deserialization vulnerability (CRITICAL, CVSS 9.8) in Radius Booking <1.0.21 allows remote code execution and full compromise. Upgrade to 1.0.21 ASAP. Details: https://radar.offseq.com/threat/cve-2026-119516-deserialization-of-untrusted-data-in-mamunur-rashid-radius-booking-booking-calendar-for-3...
CVE-2026-119516: Deserialization of Untrusted Data in Mamunur Rashid Radius Book
This vulnerability involves unsafe deserialization of untrusted data in the Radius Booking application, which enables attackers to perform object injection attacks. This can lead to remote code execution or other severe impacts due to the a
radar.offseq.com
November 6, 2026 at 9:00 AM
stemshop.bsky.social
🚨 CVE-2026-124079 — CVSS 9.3 CRITICAL

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data v...

🔎 https://stemshop.top/cve/CVE-2026-124079

#CVE #CyberSecurity #InfoSec
November 9, 2026 at 2:07 PM
hugovalters.bsky.social
CVE-2026-81657 IBM Guardium Data Protection 12.2 insecure deserialization lets a remote unauthenticated attacker execute arbitrary code. CVSS 9.8, no patch confirmed. Isolate or update immediately. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-81657/
November 9, 2026 at 5:20 PM
thehackerwire.bsky.social
🔴 CVE-2026-124079 - Critical (9.8)

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrus...

https://www.thehackerwire.com/vulnerability/CVE-2026-124079/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
CVE-2026-124079 - Critical
November 9, 2026 at 1:46 PM
threatroundup.bsky.social
New critical vulnerability in rConfig Core: CVE-2026-124079, CVSS 9.3. rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data… No public exploit reported yet. #CVE #vulnerability

threatroundup.com/cve/cve-2026...
November 9, 2026 at 1:45 PM
vulnsea.com
🌑 HADAL · actively exploited critical
CVE-2026-92190: Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVSS 9.8 · EPSS 0.6% · 0day
https://vulnsea.com/cve/CVE-2026-92190

#CVE #infosec #cybersecurity #threatintel
CVE-2026-92190 — Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight f…
vulnsea.com
November 6, 2026 at 1:28 AM
euvd-bot.bsky.social
🚨 EUVD-2026-120037
📊 9.3/10
🏢 rconfig

📝 rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated netw...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120037

#cybersecurity #infosec #cve #euvd
November 9, 2026 at 1:10 PM
euvd-bot.bsky.social
🚨 EUVD-2026-120866
📊 7.5/10

📝 A use-after-free flaw was found in GStreamer core buffer value deserialization. When crafted serialized buffer data contains an invalid character, an error path f...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120866

#cybersecurity #infosec #cve #euvd
November 10, 2026 at 12:02 PM
euvd-bot.bsky.social
🚨 EUVD-2026-119902
📊 n/a
🏢 Apache Software Foundation

📝 Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the seri...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119902

#cybersecurity #infosec #cve #euvd
November 9, 2026 at 11:04 AM
euvd-bot.bsky.social
🚨 EUVD-2026-119685
📊 8.4/10
🏢 IBM

📝 IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119685

#cybersecurity #infosec #cve #euvd
November 8, 2026 at 6:03 PM
euvd-bot.bsky.social
🚨 EUVD-2026-119272
📊 8.6/10
🏢 treeio

📝 Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119272

#cybersecurity #infosec #cve #euvd
November 7, 2026 at 3:01 PM