CVE-2026-65617
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and
CVSS
8.8
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 27 jul 2026 · Última mod.: 27 jul 2026 · CWE-502
Sin historial EPSS suficiente todavía.
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-149748.1 ALT—
———IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.12hCVE-2026-145129.8 CRÍ—
———IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.12hCVE-2026-667139.8 CRÍ—
———Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
(only when Tribes clustering is enabled, which is off by default) allows an
unauthenticated remote attacker with network access to the clustering port to
execute arbitrary code via a crafted serialized Java object delivered to the cluster
channel and deserialized in
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are
recommended to upgrade to version 2.0.1, which fixes this issue by removing the
clustering feature entirely.4hCVE-2026-1175610.0 CRÍ—
——0A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.20hCVE-2026-630779.8 CRÍ—
——0In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol17hCVE-2026-159628.8 ALT30.8%
——9The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.2d