CVE-2026-53914

CriticalCVSS 9.8/10Last modified Jun 27, 2026

Description

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Jun 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-539158.8In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configurationCVE-2026-539167.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticatCVE-2026-539177.5Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ BCVE-2026-539188.8odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a peCVE-2026-53925.4Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an OOB read on the heap. The missing bounds check is in the inCVE-2026-539208.7odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPCVE-2026-539219.8odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler wCVE-2026-539226.5odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on theCVE-2026-539237.5vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensionCVE-2026-539248.7Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable paramCVE-2026-539257.8Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py inCVE-2026-539266.3NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty s
CVE-2026-53914: Critical severity, CVSS 9.8 | Vulnix