/
attack_type:insecure_deserialization × limpar

Resultados

2 casos · pág. 1/1

yokai.hakaisecurity.io · high

CVE-2026-25769: Wazuh cluster insecure deserialization lets a compromised worker execute commands on the master node

Hakai Security Research Team disclosed CVE-2026-25769, an RCE flaw from insecure deserialization (CWE-502) in the cluster protocol of Wazuh up to version 4.14.1. A compromised worker node can run arbitrary commands on the master node. The researchers reported it through the GitHub Security Advisory program, and the Wazuh team acknowledged…

CVE-2026-25769
yokai.hakaisecurity.io · high

CVE-2026-12191: Insecure pickle deserialization in comma.ai openpilot modeld enables root RCE on comma 3X

The Hakai Yokai Research Team disclosed CVE-2026-12191, an insecure deserialization flaw (CWE-502) in openpilot, the open-source Level 2 driver assistance system from comma.ai that supports over 275 vehicle models. The modeld process calls Python pickle.load() / pickle.loads() on model and metadata files with no validation, signature or h…

CVE-2026-12191 automotive