CWE-502 · Deserialization of Untrusted Data (page 10)
Page 10 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58998 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <=… |
CVE-2025-58636 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP G… |
CVE-2025-58619 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a… |
CVE-2025-58592 | High | 8.1 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2025-54719 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beaut… |
CVE-2025-53586 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1. |
CVE-2025-53242 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1. |
CVE-2025-49393 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from… |
CVE-2025-49386 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Pr… |
CVE-2025-48086 | Medium | 5.5 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from… |
CVE-2025-64164 | Critical | 9.8 | 2025-11-06 | Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections… |
CVE-2025-8871 | Medium | 5.6 | 2025-11-05 | The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted… |
CVE-2025-64353 | High | 8.8 | 2025-10-31 | Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3. |
CVE-2025-63675 | Medium | 6.9 | 2025-10-31 | cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py. |
CVE-2025-12058 | | 2025-10-29 | The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading… | |
CVE-2025-62368 | Critical | 9.0 | 2025-10-28 | Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe… |
CVE-2025-12305 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobControll… |
CVE-2025-34292 | | 2025-10-27 | Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is p… | |
CVE-2025-46183 | High | 8.2 | 2025-10-24 | The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file… |
CVE-2025-62025 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8. |
CVE-2025-62008 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For Woo… |
CVE-2025-60238 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in universam UNIVERSAM universam-demo allows Object Injection.This issue affects UNIVERSAM: from n/a through <=… |
CVE-2025-60234 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Single Property single-property allows Object Injection.This issue affects Single Property: fro… |
CVE-2025-60232 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro… |
CVE-2025-60228 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Knowledge Base kbase allows Object Injection.This issue affects Knowledge Base: from n/a throug… |
CVE-2025-60226 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a throu… |
CVE-2025-60225 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in AncoraThemes BugsPatrol bugspatrol allows Object Injection.This issue affects BugsPatrol: from n/a through <… |
CVE-2025-60224 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Object Injection.This issue affects Subscribe t… |
CVE-2025-60221 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync… |
CVE-2025-60216 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8. |
CVE-2025-60215 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4. |
CVE-2025-60214 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through… |
CVE-2025-60213 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13. |
CVE-2025-60212 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2. |
CVE-2025-60210 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue… |
CVE-2025-60209 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injectio… |
CVE-2025-60039 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0. |
CVE-2025-59007 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue af… |
CVE-2025-52740 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a thro… |
CVE-2025-52737 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: f… |
CVE-2025-49380 | Critical | 9.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affe… |
CVE-2025-32283 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <=… |
CVE-2025-31634 | High | 8.8 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3… |
CVE-2025-11938 | Medium | 5.6 | 2025-10-19 | A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of t… |
CVE-2017-20208 | Critical | 9.8 | 2025-10-18 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all… |
CVE-2017-20207 | Critical | 9.8 | 2025-10-18 | The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input fr… |
CVE-2017-20206 | Critical | 9.8 | 2025-10-18 | The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from… |
CVE-2025-62515 | Critical | 9.8 | 2025-10-17 | pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deseria… |
CVE-2025-62420 | High | 8.8 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vulnerability exists in the H2 database con… |
CVE-2025-62419 | High | 7.5 | 2025-10-17 | DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB… |
CVE-2025-49655 | Critical | 9.8 | 2025-10-17 | Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously u… |
CVE-2025-54539 | Critical | 9.8 | 2025-10-16 | A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP u… |
CVE-2025-59287 | Critical | 9.8 | 2025-10-14 | Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-59285 | High | 7.0 | 2025-10-14 | Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2025-59237 | High | 8.8 | 2025-10-14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-11622 | High | 7.8 | 2025-10-13 | Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges. |
CVE-2025-61505 | Medium | 6.5 | 2025-10-10 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps`… |
CVE-2025-35051 | Critical | 9.8 | 2025-10-09 | Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attack… |
CVE-2025-35050 | Critical | 9.8 | 2025-10-09 | Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbi… |
CVE-2025-60834 | Medium | 6.5 | 2025-10-08 | A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input. |
CVE-2025-60830 | Medium | 6.5 | 2025-10-08 | redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key. |
CVE-2025-60828 | Medium | 6.5 | 2025-10-08 | WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface. |
CVE-2025-11346 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation… |
CVE-2025-11345 | Medium | 5.5 | 2025-10-06 | A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes… |
CVE-2025-10363 | | 2025-10-06 | Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at lea… | |
CVE-2025-61765 | Medium | 6.4 | 2025-10-06 | python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior… |
CVE-2023-49886 | Critical | 9.8 | 2025-10-06 | IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By s… |
CVE-2025-11273 | Medium | 6.3 | 2025-10-04 | A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provid… |
CVE-2025-61677 | Low | 2.5 | 2025-10-03 | DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted… |
CVE-2025-61622 | Critical | 9.8 | 2025-10-01 | Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary… |
CVE-2025-11135 | High | 7.3 | 2025-09-29 | A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadL… |
CVE-2025-58384 | Critical | 10.0 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc ad… |
CVE-2025-10975 | Medium | 6.3 | 2025-09-25 | A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. This vulnerability affects the function experiments.robot.bridge… |
CVE-2025-10974 | Medium | 6.3 | 2025-09-25 | A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /ca… |
CVE-2025-10965 | Medium | 6.3 | 2025-09-25 | A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllm_call of the file lazyllm/components/d… |
CVE-2025-10950 | Medium | 6.3 | 2025-09-25 | A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/s… |
CVE-2025-56816 | High | 8.8 | 2025-09-24 | Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to t… |
CVE-2025-48459 | Medium | 5.3 | 2025-09-24 | Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade t… |
CVE-2025-26399 | Critical | 9.8 | 2025-09-23 | SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, wo… |
CVE-2025-58662 | High | 7.2 | 2025-09-22 | Deserialization of Untrusted Data vulnerability in awesomesupport Awesome Support awesome-support allows Object Injection.This issue affects Awesome Support: f… |
CVE-2025-57919 | High | 7.2 | 2025-09-22 | Deserialization of Untrusted Data vulnerability in ConveyThis ConveyThis conveythis-translate allows Object Injection.This issue affects ConveyThis: from n/a t… |
CVE-2025-53465 | High | 7.2 | 2025-09-22 | Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n… |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10769 | Medium | 6.3 | 2025-09-21 | A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. S… |
CVE-2025-10768 | Medium | 6.3 | 2025-09-21 | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Dri… |
CVE-2025-6544 | Critical | 9.8 | 2025-09-21 | A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The v… |
CVE-2025-9906 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras mo… |
CVE-2025-59713 | Medium | 6.8 | 2025-09-19 | Snipe-IT before 8.1.18 allows unsafe deserialization. |
CVE-2025-10035 | Critical | 10.0 | 2025-09-18 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deseriali… |
CVE-2025-9083 | Critical | 9.8 | 2025-09-18 | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection… |
CVE-2025-59050 | High | 8.4 | 2025-09-16 | Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message u… |
CVE-2025-10492 | Critical | 9.8 | 2025-09-16 | A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute ar… |
CVE-2025-59328 | Medium | 6.5 | 2025-09-15 | A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the insecure deserialization of untrusted data… |
CVE-2025-58748 | Critical | 9.8 | 2025-09-15 | Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not v… |
CVE-2025-58046 | Critical | 9.8 | 2025-09-15 | Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote co… |
CVE-2025-10433 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/… |
CVE-2025-10252 | Low | 3.1 | 2025-09-11 | A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation cau… |
CVE-2025-10164 | High | 7.3 | 2025-09-09 | A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The man… |
CVE-2025-55232 | Critical | 9.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. |