Tribulant Software Newsletters: Deserialization of Untrusted Data (CVE-2026-94075)
A Deserialization of Untrusted Data vulnerability exists in Tribulant Software Newsletters (newsletters-lite) from version n/a through 4.18.1, allowing Object Injection.
CVE search metadata
CVE search record: CVE-2026-94075. Severity: critical. CVSS: 9.8. KEV: no. Brief: Tribulant Software Newsletters: Deserialization of Untrusted Data (CVE-2026-94075). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tribulant-newsletters-deserialization/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 24, 11:14 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, has_poc, lastmod, poc_references, references, updates
Sources: 1
Tribulant Software Newsletters (newsletters-lite) is affected by a Deserialization of Untrusted Data vulnerability (CVE-2026-94075). This issue allows for Object Injection. The vulnerability affects versions from n/a through 4.18.1 and carries a CVSS v3.1 base score of 9.8.