CWE-502 Deserialization of Untrusted Data

Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Backstage: Improper validation of TechDocs MkDocs configuration

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

ChromaDB Python project has a pre-authentication code injection vulnerability

Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs

Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler

Apache Airflow XCom API permits unsafe deserialization through JSON string literals

Apache Airflow exception-node deserialization permits arbitrary callable execution

Incomplete fix for Apache Log4j vulnerability

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Duplicate Advisory: Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

Duplicate Advisory: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval

Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper

Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py