CVE Watch15 oct 2026

CVE-2018-12023

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally

CVSS

7.5

Alto

EPSS

8.9%

p95

KEV

—

Exploit Today

0-100

Publicado: 21 mar 2019 · Última mod.: 15 oct 2026 · CWE-502

EPSS · 30d

8.9%EPSS · 30 días8.9%

2026-10-012026-10-28

Descripción técnica

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-107238—

—

———A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.5h CVE-2023-22793—

—

———A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.5h CVE-2026-621319.8 CRÍ

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.12h CVE-2026-620189.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.8h CVE-2026-620179.8 CRÍ

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.10h CVE-2026-620169.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.12h