CWE-502 · Deserialization of Untrusted Data (page 16)
Page 16 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4803 | High | 7.2 | 2025-05-21 | The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2025-47277 | Critical | 9.8 | 2025-05-20 | vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `… |
CVE-2025-48018 | High | 7.5 | 2025-05-20 | An authenticated user can modify application state data. |
CVE-2025-39356 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbak… |
CVE-2025-39354 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: fro… |
CVE-2025-39349 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a throu… |
CVE-2025-39348 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2025-32928 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2. |
CVE-2025-32927 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through… |
CVE-2025-47581 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue af… |
CVE-2025-39410 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Them… |
CVE-2025-47582 | Critical | 9.8 | 2025-05-19 | Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chat… |
CVE-2025-4905 | Medium | 5.3 | 2025-05-19 | A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function load_qc_pickl of the file bases… |
CVE-2025-48134 | High | 7.2 | 2025-05-16 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a th… |
CVE-2025-4742 | Medium | 5.3 | 2025-05-16 | A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of… |
CVE-2025-4740 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in BeamCtrl Airiana up to 11.0. It has been declared as problematic. This vulnerability affects unknown code of the file coef. The ma… |
CVE-2025-47784 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nicknam… |
CVE-2025-4701 | Medium | 5.3 | 2025-05-15 | A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the… |
CVE-2025-47292 | | 2025-05-14 | Cap Collectif is an online decision making platform that integrates several tools. Before commit 812f2a7d271b76deab1175bdaf2be0b8102dd198, the `DebateAlternate… | |
CVE-2025-3623 | Critical | 9.1 | 2025-05-14 | The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted… |
CVE-2025-30384 | High | 7.4 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-30382 | High | 7.8 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-30378 | High | 7.0 | 2025-05-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2025-42999 | Critical | 9.1 | 2025-05-13 | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could… |
CVE-2025-30012 | Critical | 10.0 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to sen… |
CVE-2025-46738 | Medium | 6.6 | 2025-05-12 | An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code. |
CVE-2025-47732 | High | 8.7 | 2025-05-08 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-47683 | High | 7.2 | 2025-05-07 | Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance… |
CVE-2025-47629 | High | 7.2 | 2025-05-07 | Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a… |
CVE-2025-0855 | Critical | 9.8 | 2025-05-06 | The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in t… |
CVE-2025-30165 | High | 8.0 | 2025-05-06 | vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node co… |
CVE-2025-43852 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43851 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43850 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43849 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43848 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43847 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-43846 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The… |
CVE-2025-4260 | Medium | 4.3 | 2025-05-05 | A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web… |
CVE-2025-46567 | Medium | 6.1 | 2025-05-01 | LLama Factory enables fine-tuning of large language models. Prior to version 1.0.0, a critical vulnerability exists in the `llamafy_baichuan2.py` script of the… |
CVE-2025-23254 | High | 8.8 | 2025-05-01 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRT… |
CVE-2025-32444 | Critical | 10.0 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration… |
CVE-2025-34491 | High | 8.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sendi… |
CVE-2025-34489 | High | 7.8 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a… |
CVE-2023-35815 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data. |
CVE-2023-35814 | Low | 3.5 | 2025-04-28 | DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms. |
CVE-2025-2105 | High | 8.1 | 2025-04-26 | The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted inp… |
CVE-2025-3935 | High | 8.1 | 2025-04-25 | ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page an… |
CVE-2025-46481 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affect… |
CVE-2025-46473 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a thr… |
CVE-2025-23249 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of t… |
CVE-2025-3857 | High | 7.5 | 2025-04-21 | When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underl… |
CVE-2025-32434 | Critical | 9.8 | 2025-04-18 | PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In ve… |
CVE-2025-29953 | Critical | 9.8 | 2025-04-18 | Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 wh… |
CVE-2025-39588 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects U… |
CVE-2025-39551 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from… |
CVE-2025-39550 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity… |
CVE-2025-39527 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebS… |
CVE-2025-32686 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <=… |
CVE-2025-32662 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0. |
CVE-2025-32658 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5. |
CVE-2025-32647 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from… |
CVE-2025-32572 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through <=… |
CVE-2025-32571 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Boo… |
CVE-2025-27287 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in ssvadim SS Quiz ssquiz allows Object Injection.This issue affects SS Quiz: from n/a through <= 2.0.5. |
CVE-2025-27286 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in saoshyant1994 Saoshyant Slider saoshyant-slider allows Object Injection.This issue affects Saoshyant Slider… |
CVE-2025-39565 | Medium | 6.6 | 2025-04-16 | Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaP… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |
CVE-2025-30985 | Critical | 9.8 | 2025-04-15 | Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affects GNUCommerce: from n/a through <= 1… |
CVE-2025-3622 | Medium | 5.5 | 2025-04-15 | A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference… |
CVE-2025-3590 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manip… |
CVE-2025-31935 | Medium | 6.2 | 2025-04-11 | Subnet Solutions PowerSYSTEM Center is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the API may trigger… |
CVE-2025-3439 | Critical | 9.8 | 2025-04-11 | The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in a… |
CVE-2025-31932 | High | 8.8 | 2025-04-11 | Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Co… |
CVE-2025-32607 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: f… |
CVE-2025-32569 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a throu… |
CVE-2025-32568 | Critical | 9.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace… |
CVE-2025-32144 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager… |
CVE-2025-32143 | High | 8.8 | 2025-04-11 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2… |
CVE-2025-32145 | High | 8.8 | 2025-04-10 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-32375 | Critical | 9.8 | 2025-04-09 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserializatio… |
CVE-2025-30285 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-30284 | High | 8.4 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-24447 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-29793 | High | 7.2 | 2025-04-08 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-3413 | Medium | 6.3 | 2025-04-08 | A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerabi… |
CVE-2025-3425 | | 2025-04-07 | The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deseri… | |
CVE-2025-2251 | Medium | 6.2 | 2025-04-07 | A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulne… |
CVE-2025-31175 | High | 8.4 | 2025-04-07 | Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2025-3250 | Medium | 4.3 | 2025-04-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-27520 | Critical | 9.8 | 2025-04-04 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused b… |
CVE-2025-2244 | Critical | 9.8 | 2025-04-04 | A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-suppli… |
CVE-2025-3165 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The m… |
CVE-2025-3162 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/… |
CVE-2025-30889 | High | 8.8 | 2025-04-03 | Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: fr… |
CVE-2024-39780 | High | 7.8 | 2025-04-02 | A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameter… |
CVE-2025-31612 | Critical | 9.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in Sabuj Kundu CBX Poll cbxpoll allows Object Injection.This issue affects CBX Poll: from n/a through <= 2.0.4. |
CVE-2025-30892 | High | 8.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n… |
CVE-2025-27130 | High | 8.8 | 2025-04-01 | Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may… |
CVE-2025-30065 | Critical | 9.8 | 2025-04-01 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to… |