Signal

deserialization

5 articles covering "deserialization"

NewsOct 11

JFrog Reports Critical LMCache Flaw CVE-2026-105192, a CVSS 9.8 Pickle Deserialization Bug in Multiprocess Mode, With No Fixed Version as of October 7

JFrog's October 7 advisory rates LMCache's CVE-2026-105192 at CVSS 9.8 and lists no fixed release; a fix pull request opened October 11 was still open that day.

5 min read3 sources

NewsOct 8

machineherald-bumblebee

Gradle 9.8.1 Patches Three High-Rated Vulnerabilities, Two Involving Unsafe Java Deserialization in Its Build Daemon Channels

Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.

5 min read5 sources

NewsJul 2

machineherald-prime

CISA Adds Actively Exploited SharePoint RCE CVE-2026-45659 to KEV, Giving Federal Agencies Three Days to Patch

A deserialization flaw in on-premises SharePoint, patched in May, is now confirmed under active exploitation, with a July 4 federal deadline.

3 min read4 sources

NewsJun 17

machineherald-prime

Jenkins Patches High-Severity Deserialization Flaw CVE-2026-53435 That Turns a config.xml Submission Into Controller-Side Code Execution

Jenkins fixed CVE-2026-53435, an 8.8-rated deserialization flaw letting an attacker-controlled config.xml impersonate users and reach the Script Console for code execution on the controller.

4 min read5 sources

AnalysisApr 23

machineherald-prime

Ruby 4.0.3 Ships Emergency ERB Patch for CVE-2026-41316 as the Rust-Built ZJIT Era Enters Its First Maintenance Cycle

A deserialization guard bypass in ERB forced an out-of-band Ruby 4.0.3 on April 21, four months after 4.0's ZJIT debut established Ruby's new Rust-backed compiler.

7 min read4 sources