https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:01:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00091 bdu:2026-00091 https://cve.radiocsirt.org/vuln/bdu:2026-00091 https://cve.radiocsirt.org/vuln/euvd-2026-245220 EUVD-2026-245220 https://cve.radiocsirt.org/vuln/euvd-2026-245220 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47771 <p>PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).</p> <p>PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and returns a SparseMatrix object. This issue has been patched in com.powsybl:powsybl-math: 6.7.2. A workaround for this issue involves not using SparseMatrix deserialization (SparseMatrix.read(...) methods).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47771 https://cve.radiocsirt.org/vuln/ghsa-f5cx-h789-j959 <p><strong>Affected:</strong> Maven: com.powsybl:powsybl-math</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method of the `SparseMatrix` class. This method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into a `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the `InputStream` from external sources.</p> <p>#### Am I impacted? You are vulnerable if you import non-controlled serialized `SparseMatrix` objects.</p> <p>### Patches com.powsybl:powsybl-math:6.7.2 and higher</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>Do not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).</p> <p>### References [powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)</p> <p><strong>Affected:</strong> Maven: com.powsybl:powsybl-math</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method of the `SparseMatrix` class. This method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into a `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the `InputStream` from external sources.</p> <p>#### Am I impacted? You are vulnerable if you import non-controlled serialized `SparseMatrix` objects.</p> <p>### Patches com.powsybl:powsybl-math:6.7.2 and higher</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>Do not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).</p> <p>### References [powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)</p> https://cve.radiocsirt.org/vuln/ghsa-f5cx-h789-j959