CWE-502 · Deserialization of Untrusted Data (page 11)
Page 11 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54897 | High | 8.8 | 2025-09-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-53303 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a… |
CVE-2025-48101 | High | 8.8 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact fo… |
CVE-2025-47579 | Critical | 9.0 | 2025-09-09 | Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through… |
CVE-2025-41701 | High | 7.8 | 2025-09-09 | An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engine… |
CVE-2025-42944 | Critical | 10.0 | 2025-09-09 | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious… |
CVE-2025-58757 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the `pickle_operations` function in `monai… |
CVE-2025-58756 | High | 8.8 | 2025-09-09 | MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in `model_dict = torch.load(full_path, map… |
CVE-2025-58782 | Medium | 6.5 | 2025-09-08 | Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1… |
CVE-2025-58839 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eD… |
CVE-2025-58815 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming So… |
CVE-2025-48535 | High | 7.8 | 2025-09-04 | In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulner… |
CVE-2025-32312 | High | 7.8 | 2025-09-04 | In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process d… |
CVE-2025-9365 | High | 7.8 | 2025-09-03 | Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacke… |
CVE-2025-53690 | Critical | 9.0 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects… |
CVE-2025-58644 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition ltl-freight-quotes-tql-edition allows Object Injection.Th… |
CVE-2025-58643 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition ltl-freight-quotes-daylight-edition allows Object In… |
CVE-2025-58642 | High | 7.2 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition ltl-freight-quotes-day-ross-edition allows Object… |
CVE-2025-53691 | High | 8.8 | 2025-09-03 | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This… |
CVE-2025-58163 | High | 8.8 | 2025-09-03 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.185 and earlier contain a deserialization of untrusted data vul… |
CVE-2025-9260 | Medium | 6.5 | 2025-09-03 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versio… |
CVE-2025-7976 | High | 7.8 | 2025-09-02 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-9188 | High | 7.8 | 2025-09-02 | There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploit… |
CVE-2025-5662 | Critical | 9.8 | 2025-09-02 | A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remo… |
CVE-2024-28988 | Critical | 9.8 | 2025-09-01 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2025-6507 | Critical | 9.8 | 2025-09-01 | A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution an… |
CVE-2025-54742 | High | 8.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-53584 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection… |
CVE-2025-53583 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spo… |
CVE-2025-53572 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: f… |
CVE-2025-53243 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory a… |
CVE-2025-52761 | Critical | 9.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager… |
CVE-2024-13980 | | 2025-08-27 | H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoi… | |
CVE-2025-58218 | High | 7.2 | 2025-08-27 | Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Inject… |
CVE-2025-57773 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injecti… |
CVE-2025-43960 | High | 8.6 | 2025-08-25 | Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), lea… |
CVE-2022-45134 | Critical | 9.8 | 2025-08-22 | Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML… |
CVE-2025-52287 | High | 8.8 | 2025-08-22 | OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability. |
CVE-2025-54923 | | 2025-08-20 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated us… | |
CVE-2025-54053 | Medium | 6.6 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <… |
CVE-2025-54014 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCe… |
CVE-2025-54012 | High | 7.2 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: fr… |
CVE-2025-54007 | High | 8.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid an… |
CVE-2025-53560 | High | 8.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0. |
CVE-2025-53299 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affe… |
CVE-2025-49890 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a t… |
CVE-2025-49438 | High | 8.1 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through… |
CVE-2025-49434 | Critical | 9.8 | 2025-08-20 | Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through <= 1… |
CVE-2025-8289 | High | 7.5 | 2025-08-20 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization o… |
CVE-2025-8145 | High | 8.8 | 2025-08-20 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization o… |
CVE-2025-8875 | High | 7.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. |
CVE-2025-8963 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/te… |
CVE-2025-54686 | Critical | 9.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2. |
CVE-2025-49869 | High | 8.8 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <=… |
CVE-2025-47536 | High | 7.2 | 2025-08-14 | Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through… |
CVE-2025-23303 | High | 7.8 | 2025-08-13 | NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A succe… |
CVE-2025-34153 | | 2025-08-13 | Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization… | |
CVE-2025-2180 | | 2025-08-13 | An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administ… | |
CVE-2025-7384 | Critical | 9.8 | 2025-08-13 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4… |
CVE-2025-53772 | High | 8.8 | 2025-08-12 | Deserialization of untrusted data in Web Deploy allows an authorized attacker to execute code over a network. |
CVE-2025-49712 | High | 8.8 | 2025-08-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-55010 | Critical | 9.1 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the Project… |
CVE-2025-40759 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions… |
CVE-2024-54678 | High | 8.2 | 2025-08-12 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1… |
CVE-2025-45146 | Critical | 9.8 | 2025-08-11 | ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability all… |
CVE-2025-8747 | High | 7.8 | 2025-08-11 | A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution… |
CVE-2025-53606 | Critical | 9.8 | 2025-08-08 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to u… |
CVE-2025-8708 | Medium | 5.0 | 2025-08-08 | A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of th… |
CVE-2025-54886 | High | 8.4 | 2025-08-08 | skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain a… |
CVE-2025-55136 | Medium | 5.7 | 2025-08-07 | ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used. |
CVE-2025-54640 | Medium | 5.5 | 2025-08-06 | ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exce… |
CVE-2025-54639 | Medium | 5.5 | 2025-08-06 | ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exce… |
CVE-2025-54638 | Medium | 5.5 | 2025-08-06 | Issue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of this vulnerability may affect the availability of the ad se… |
CVE-2025-54620 | Medium | 5.5 | 2025-08-06 | Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-50472 | Critical | 9.8 | 2025-08-01 | The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_model_meta()` f… |
CVE-2025-50460 | Critical | 9.8 | 2025-08-01 | A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from t… |
CVE-2025-49083 | High | 7.2 | 2025-07-31 | CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administra… |
CVE-2025-25692 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-25691 | Medium | 6.5 | 2025-07-30 | A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-53078 | High | 8.0 | 2025-07-29 | Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system |
CVE-2025-8266 | Medium | 6.3 | 2025-07-28 | A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the… |
CVE-2025-8227 | Medium | 6.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-54366 | High | 8.8 | 2025-07-26 | FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical d… |
CVE-2025-26397 | High | 7.8 | 2025-07-24 | SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privile… |
CVE-2025-4393 | Medium | 6.5 | 2025-07-24 | Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a b… |
CVE-2016-15044 | | 2025-07-23 | A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorserv… | |
CVE-2025-43489 | Medium | 5.2 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted… |
CVE-2025-7916 | Critical | 9.8 | 2025-07-21 | WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code o… |
CVE-2025-7876 | Medium | 6.3 | 2025-07-20 | A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file downloa… |
CVE-2025-53770 | Critical | 9.8 | 2025-07-20 | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware… |
CVE-2025-7697 | Critical | 9.8 | 2025-07-19 | The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all version… |
CVE-2025-7696 | Critical | 9.8 | 2025-07-19 | The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2025-7433 | High | 8.8 | 2025-07-17 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. |
CVE-2025-31422 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Vis… |
CVE-2025-30973 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a throu… |
CVE-2025-30949 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat o… |
CVE-2025-28961 | Critical | 9.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Object Injection.This issue affects URL Shortener: from… |
CVE-2025-24779 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in NooTheme Yogi yogi allows Object Injection.This issue affects Yogi: from n/a through < 2.9.3. |
CVE-2025-24777 | High | 8.8 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7. |
CVE-2025-53990 | High | 7.2 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/… |