Live

* CISA Exposes Secrets, Credentials in ‚Private‘ Repo* AI Agents Are Shifting Identity Security Budget Dynamics* GitHub Confirms Breach, 4K Internal Repos Stolen* Canvas Breach Disrupts Schools & Colleges Nationwide* It’s Patch Tuesday for Microsoft & Not a Zero-Day In Sight* CISA Admin Leaked AWS GovCloud Keys on Github* Why Chargebacks are Just One Piece of the Fraud Puzzle* Former US execs plead guilty to aiding tech support scammers* US and Canada arrest and charge suspected Kimwolf botnet admin* Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access* CISA Exposes Secrets, Credentials in ‚Private‘ Repo* AI Agents Are Shifting Identity Security Budget Dynamics* GitHub Confirms Breach, 4K Internal Repos Stolen* Canvas Breach Disrupts Schools & Colleges Nationwide* It’s Patch Tuesday for Microsoft & Not a Zero-Day In Sight* CISA Admin Leaked AWS GovCloud Keys on Github* Why Chargebacks are Just One Piece of the Fraud Puzzle* Former US execs plead guilty to aiding tech support scammers* US and Canada arrest and charge suspected Kimwolf botnet admin* Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

CVE-2026-48207 Critical 22. Mai 2026 CVSS 9.8/10

🔴 CVE-2026-48207: Critical Schwachstelle

CVE IDCVE-2026-48207

CVSS Score9.8/10

SchweregradCritical

Patch verfuegbarNein

Betroffene SystemeVarious

AngriffsvektorNetwork

NVD Quelle

Zusammenfassung

Deserialization of untrusted data in Apache Fory PyFory. PyFory’s ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data using PyFory Python-native mode with strict mode disabled and relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes.

This issue affects Apache Fory: from before 1.0.0.

Mitigation: Users of Apache Fory are recommended to upgrade to version 1.0.0 or later, which enforces DeserializationPolicy validation for the affected ReduceSerializer paths and thus fixes this issue.

Quelle: CVE-2026-48207

🛒