https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:40:04 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0834 certfr-2026-avi-0834 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0834 https://cve.radiocsirt.org/vuln/cnvd-2026-28625 cnvd-2026-28625 https://cve.radiocsirt.org/vuln/cnvd-2026-28625 https://cve.radiocsirt.org/vuln/euvd-2026-332481 EUVD-2026-332481 https://cve.radiocsirt.org/vuln/euvd-2026-332481 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13772 <p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 &#39;s Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries</p> <p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 &#39;s Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13772 https://cve.radiocsirt.org/vuln/ghsa-w6x5-7fjj-v49p <p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 &#39;s Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries</p> <p>IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 &#39;s Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries</p> https://cve.radiocsirt.org/vuln/ghsa-w6x5-7fjj-v49p