https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 23:40:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-31072 <p><strong>Affected:</strong> Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Satellite 6</p> <p>The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers</p> <p><strong>Affected:</strong> Red Hat Ansible Automation Platform 2, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Satellite 6</p> <p>The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object function allows for arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any class available in the Python environment. An attacker can exploit this by submitting a specially crafted JSON or CBOR payload to an application using these serializers</p> https://cve.radiocsirt.org/vuln/cve-2026-31072