zerodayinitiative.com resources

zerodayinitiative.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-02.

AI 4 Deser 4 Python 4 RCE 3 XXE 1

Date Added	Resource	Excerpt
2026-11-02 2026	ZDI-26-797 Meta FAIRChem pickle deserialization AI Deser Python	This advisory (ZDI-26-797) details a critical pickle deserialization vulnerability within Meta's FAIRChem software. Successful exploitation of this flaw allows an unauthenticated remote attacker to achieve arbitrary code execution by convincing a user to load a specially crafted pickle file. This could lead to significant compromise of systems running the vulnerable FAIRChem application. No bounty payout amount is specified in this content.
2026-11-02 2026	ZDI-26-845 MLflow deserialization of untrusted data AI Deser Python RCE	Advisory ZDI-26-845 details an MLflow Statsmodels _load_model deserialization vulnerability. Remote attackers can execute arbitrary code by tricking users into visiting a malicious page or opening a malicious file. This flaw arises from insufficient validation of user-supplied data, leading to the deserialization of untrusted input and code execution within the user's context. The vulnerability is fixed in MLflow 3.15.0.
2026-11-01 2026	ZDI-26-839 MLflow PickleEvaluationArtifact deserialization RCE AI Deser Python RCE	Advisory detailing ZDI-26-839, a remote code execution vulnerability in MLflow due to improper validation of user-supplied data during the parsing of pickle files. This flaw allows remote attackers to execute arbitrary code in the context of the current process, requiring user interaction to exploit by visiting a malicious page or opening a malicious file. The vulnerability is fixed in MLflow 3.13.0.
2026-10-31 2026	ZDI-26-816 Ultralytics load_dataset_cache_file deserialization RCE AI Deser Python RCE	Writeup of ZDI-26-816, a deserialization of untrusted data remote code execution vulnerability in Ultralytics' `load_dataset_cache_file` function. Successful exploitation requires user interaction and allows remote attackers to execute arbitrary code within the context of the current user by leveraging improper validation of user-supplied data. The primary mitigation is to restrict interaction with the affected product.
2026-10-31 2026	ZDI-26-811 MailEnable parseObjectResponse XXE XXE	Advisory ZDI-26-811 details a MailEnable parseObjectResponse XML External Entity (XXE) processing vulnerability. This flaw, exploitable by authenticated remote attackers, allows disclosure of sensitive information within the service account context due to improper restriction of XXE references. The vulnerability is fixed in version 10.60.