CVE-2026-126994
A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.
CVSS
6.3
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 nov 2026 · Última mod.: 12 nov 2026 · CWE-470
Sin historial EPSS suficiente todavía.
A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.
- github.comhttps://github.com/braindecode/braindecode/
- github.comhttps://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb
- github.comhttps://github.com/braindecode/braindecode/issues/1441
- github.comhttps://github.com/braindecode/braindecode/pull/1494
- github.comhttps://github.com/braindecode/braindecode/releases/tag/v2.0.0
- github.comhttps://github.com/user-attachments/files/33599402/poc.zip
- vuldb.comhttps://vuldb.com/cve/CVE-2026-126994
- vuldb.comhttps://vuldb.com/submit/1040635
- vuldb.comhttps://vuldb.com/vuln/436293
- vuldb.comhttps://vuldb.com/vuln/436293/cti
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1240357.1 ALT48.1%
——14Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task result document.
We recommend you upgrade to amazon-braket-schemas version 1.32.2 or later.2hCVE-2026-824408.1 ALT16.0%
——5Description
Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The
allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as
"allow any class" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped
state. An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus
classpath that has a no-argument constructor.
Storm's own production artifacts contain classes with side effects suitable for this: instantiating
`org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets
and nothing closes it, and `org.apache.storm.LocalCluster` behaves similarly. Repeated submissions
therefore consume threads, sockets and memory in the most privileged daemon in the cluster.
Mitigation
Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.
Note that this is a behaviour change: a cluster running an out-of-tree scheduler strategy without an
explicit allowlist will have those topologies refused until the class is added to
`nimbus.scheduler.strategy.class.whitelist`. The rejection message names the refused class and the
configuration key.
Users who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to
the strategies they intend to permit.2hCVE-2026-786364.3 MED19.8%
——6IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.3dCVE-2026-1235446.8 MED23.1%
——7OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.6hCVE-2026-904369.8 CRÍ66.8%
——20** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4.
As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.2hCVE-2026-828947.5 ALT43.4%
——13Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.2d