CVE-2020-36188
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.
CVSS
8.1
Alto
EPSS
8.8%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 6 ene 2021 · Última mod.: 8 oct 2026 · CWE-502
8.8%EPSS · 30 días8.8%
2026-10-012026-10-28
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
- cowtowncoder.medium.comhttps://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- github.comhttps://github.com/FasterXML/jackson-databind/issues/2996
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210205-0005/
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
- cowtowncoder.medium.comhttps://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- github.comhttps://github.com/FasterXML/jackson-databind/issues/2996
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210205-0005/
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-107238——
———A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.7hCVE-2023-22793——
———A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.7hCVE-2026-621319.8 CRÍ—
———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.14hCVE-2026-620189.8 CRÍ—
———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.10hCVE-2026-620179.8 CRÍ—
———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.12hCVE-2026-620169.8 CRÍ—
———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.14h