CVE-2021-39141
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker
CVSS
8.5
Alta
EPSS
16.1%
p97
KEV
—
Exploit Today
29
0-100
Publicado: 23 de ago. de 2021 · Última mod.: 7 de out. de 2026 · CWE-434 · CWE-502
16.1%EPSS · 30 dias16.1%
2026-10-142026-11-11
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210923-0003/
- www.debian.orghttps://www.debian.org/security/2021/dsa-5004
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- x-stream.github.iohttps://x-stream.github.io/CVE-2021-39141.html
- github.comhttps://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2021/09/msg00017.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210923-0003/
- www.debian.orghttps://www.debian.org/security/2021/dsa-5004
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1269324.3 MÉD—
———Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.9hCVE-2026-1262337.2 ALT—
———A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests.10hCVE-2026-778827.8 ALT—
———A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.15hCVE-2026-71395——
———unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects Apache XML Graphics FOP: through 2.11.
Users are recommended to upgrade to version 2.12, which fixes the issue.13hCVE-2026-1263259.0 CRÍ—
———A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.17hCVE-2026-123374——
———Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.19h