CVE-2026-44795

HighCVSS 8.8/10Last modified Jul 21, 2026

Description

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-470 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-447966.5Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (CVE-2026-447978.5Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associat CVE-2026-447987.1Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepo CVE-2026-447997.5Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-44809.0A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with t CVE-2026-448007.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authoriz CVE-2026-448017.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-448027.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-448037.8Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.CVE-2026-448047.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-448055.5Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally.CVE-2026-448067.5Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a