attack_type:deserialization × has_exploit:true × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · há 1d exploit público critical

Pre-auth RCE in OpenAM via jato.clientSession unsafe deserialization (CVE-2026-33439)

Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltere…

CVE-2026-33439 CVE-2021-35464

f5.com · há 1d exploit público high

F5 Labs: Persona Bullying jailbreak and LangChain serialization injection flaw (CVE-2025-68664) show AI attacks converging with classic exploits

F5 Labs' January 2026 AI security roundup covers two attack developments: the Persona Bullying jailbreak and a critical LangChain serialization injection vulnerability (CVE-2025-68664) reachable through prompt injection. Persona Bullying applies human social-engineering tactics such as gaslighting, ridicule and social pressure to LLMs con…

CVE-2025-68664