CVE-2026-93327

UNKNOWN

Published 2026-10-30 · Source f45cbf4e-4146-4068-b7e1-655ffc2c548c

Description

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.

CWE-502

References

https://docs.cloud.google.com/support/bulletins

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-118238
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. This vulnerability can be exploited without authentication if the device is in a factory-reset state.
2026-10-30 · score —
CVE-2026-117184
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint
2026-10-30 · score —
CVE-2026-117183
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL.
2026-10-30 · score —
CVE-2026-117182
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.
2026-10-30 · score —
CVE-2026-105456
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
2026-10-30 · score —