https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:48:55 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-02157 bdu:2025-02157 https://cve.radiocsirt.org/vuln/bdu:2025-02157 https://cve.radiocsirt.org/vuln/euvd-2026-218490 EUVD-2026-218490 https://cve.radiocsirt.org/vuln/euvd-2026-218490 https://cve.radiocsirt.org/vuln/fkie_cve-2024-37361 <p>The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)</p> <p>Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.</p> <p>When developers place no restrictions on &#34;gadget chains,&#34; or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.</p> <p>The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)</p> <p>Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.</p> <p>When developers place no restrictions on &#34;gadget chains,&#34; or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-37361 https://cve.radiocsirt.org/vuln/ghsa-298w-pg84-p7jw <p>The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)</p> <p>Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.</p> <p>When developers place no restrictions on &#34;gadget chains,&#34; or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.</p> <p>The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502)</p> <p>Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.</p> <p>When developers place no restrictions on &#34;gadget chains,&#34; or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.</p> https://cve.radiocsirt.org/vuln/ghsa-298w-pg84-p7jw