Tag
#Deserialization
Critical Deserialization Vulnerability in Seroval (CVE-2026-104846)
A critical vulnerability (CVE-2026-104846, CVSS 9.8) exists in Seroval, a JavaScript value stringification library. Versions from 0.12.0 to 1.6.1 are affected, allowing attackers to execute code via malicious JSON. Update to version 1.6.2 or later immediately.
CVE-2026-103395: Unauthenticated RPyC Service Exposes LightLLM to Arbitrary Code Execution
A critical vulnerability in LightLLM through version 1.2.0 allows unauthenticated attackers to execute arbitrary code with service account privileges. The flaw is due to an exposed RPyC service with allow_pickle enabled, which deserializes attacker-supplied arguments. A CVSS score of 9.8 indicates the severity of this vulnerability.
CVE-2026-97865: Open-Web-Analytics Remote Event Queue Endpoint Deserialization Vulnerability
A deserialization vulnerability exists in Open-Web-Analytics up to version 1.8.1, specifically in the Event::loadFromArray function of the queue.php file. This vulnerability allows remote attackers to perform deserialization attacks. Affected versions should be upgraded to 1.8.2 or later.
Critical Vulnerability in Keras: Arbitrary Code Execution via Deserialization
A critical vulnerability (CVE-2026-12481) in Keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. This vulnerability has a CVSS score of 8.8 and can be exploited to achieve OS-level code execution. Affected users must update to a patched version to mitigate this risk.