CVE-2026-4860

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Mar 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-48618.8A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. Thi CVE-2026-486108.1Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found CVE-2026-486119.8Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to u CVE-2026-486128.0Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s a CVE-2026-486135.9SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, CVE-2026-486149.9An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resu CVE-2026-486157.5A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials CVE-2026-486169.3Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Prote CVE-2026-486178.2A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confide CVE-2026-486186.5A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas CVE-2026-486197.5A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on CVE-2026-48628.8A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file