CVE Watch12 de nov. de 2026

CVE-2026-124701

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker

CVSS

7.8

Alta

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-502

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

Referências oficiais

www.telerik.comhttps://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1247047.8 ALT

—

——0In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.3h CVE-2026-1061407.3 ALT

—

——0In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.4h CVE-2026-778827.8 ALT

—

——0A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.21h CVE-2026-71395—

—

——0unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.19h CVE-2026-1263259.0 CRÍ

—

——0A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.23h CVE-2026-123374—

—

——0Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.1d