CWE-502 · Deserialization of Untrusted Data (page 2)

Page 2 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-502 — newest first (page 2 of 34)
CVESeverityScorePublishedSummary
CVE-2026-19658Critical9.82026-09-22The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input…
CVE-2026-36471Medium5.82026-09-21Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into i…
CVE-2026-94301Critical9.82026-09-21The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 an…
CVE-2026-94093Medium6.32026-09-20A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of…
CVE-2026-94092Medium5.52026-09-20A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of t…
CVE-2026-94091Medium5.52026-09-20A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Lo…
CVE-2026-85017High7.52026-09-20The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled…
CVE-2026-93872High7.52026-09-18Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users w…
CVE-2026-81657Critical9.82026-09-18IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted…
CVE-2026-11711Medium6.52026-09-18IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.
CVE-2025-66455Critical9.82026-09-18LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch…
CVE-2026-10751High7.52026-09-18IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter byp…
CVE-2026-17086High8.82026-09-18The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc…
CVE-2026-93467Critical9.82026-09-18The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by send…
CVE-2026-54752Critical9.62026-09-17NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pul…
CVE-2026-76834High8.12026-09-17b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_arra…
CVE-2026-92785High8.12026-09-16Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attack…
CVE-2026-629972026-09-16Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads…
CVE-2026-20340High8.82026-09-16A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. T…
CVE-2026-20341Critical9.12026-09-16A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain r…
CVE-2026-20242Critical9.82026-09-16A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attack…
CVE-2026-20211Critical9.12026-09-16A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected devi…
CVE-2026-20307Critical9.92026-09-16A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlyin…
CVE-2026-70416Critical10.02026-09-16Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could p…
CVE-2025-59953Critical9.82026-09-16LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implem…
CVE-2026-91939Critical9.82026-09-15Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantia…
CVE-2026-12728High8.82026-09-15IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4…
CVE-2026-11729High8.52026-09-15IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4…
CVE-2023-54398Critical9.82026-09-15Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote una…
CVE-2026-91842Medium4.12026-09-15A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/…
CVE-2026-464952026-09-15OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/Rm…
CVE-2026-622632026-09-15Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows…
CVE-2026-457942026-09-15Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource f…
CVE-2026-450512026-09-15Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph fro…
CVE-2026-673992026-09-14Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
CVE-2026-13293High8.82026-09-14IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4…
CVE-2026-17416High7.82026-09-14IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure de…
CVE-2026-17156High7.82026-09-14IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure de…
CVE-2026-49400Low3.32026-09-14October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend `SessionMaker` trait stored w…
CVE-2026-61701High8.82026-09-14Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized ac…
CVE-2026-90919Critical9.82026-09-14LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes th…
CVE-2026-90614Medium6.32026-09-14A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/co…
CVE-2026-90575Low3.72026-09-13A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Han…
CVE-2026-90777High8.82026-09-13ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-suppli…
CVE-2026-90490Medium6.32026-09-13A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulat…
CVE-2026-78175High8.82026-09-12The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via…
CVE-2026-78006Critical9.82026-09-12The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instanc…
CVE-2026-84099High8.12026-09-12The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input withou…
CVE-2026-82845Critical9.92026-09-12The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowi…
CVE-2026-87719Critical9.92026-09-12GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 1…
CVE-2026-62107High8.82026-09-11Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
CVE-2026-62105Critical9.82026-09-11Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVE-2026-62103Critical9.82026-09-11Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
CVE-2026-73699High7.22026-09-10FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect opt…
CVE-2026-81784High8.12026-09-10Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
CVE-2026-82925High8.12026-09-10The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out t…
CVE-2026-57822Medium6.52026-09-10When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform…
CVE-2026-87930High8.12026-09-09MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. A…
CVE-2026-87874High8.12026-09-09A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON f…
CVE-2024-58381High7.52026-09-09PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sendi…
CVE-2026-11363Medium6.62026-09-09The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…
CVE-2026-87083Medium5.52026-09-09A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel…
CVE-2026-81385High8.82026-09-08Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
CVE-2026-77484High8.82026-09-08Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-69694High7.02026-09-08Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.
CVE-2026-65772High8.82026-09-08Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
CVE-2026-47297High8.12026-09-08Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
CVE-2026-12745Critical9.82026-09-08A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code o…
CVE-2026-12744Critical9.82026-09-08A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code o…
CVE-2026-12651High8.82026-09-08A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
CVE-2026-12650Critical9.92026-09-08A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
CVE-2026-12648High8.82026-09-08A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…
CVE-2026-77092Critical9.82026-09-08Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance releas…
CVE-2026-16502High8.82026-09-08The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via…
CVE-2026-71374Critical9.82026-09-08Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-…
CVE-2026-76967High7.82026-09-08SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with l…
CVE-2026-7861Critical9.82026-09-07Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue…
CVE-2026-86404High8.82026-09-07EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implemen…
CVE-2026-10196Critical9.82026-09-05The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions u…
CVE-2026-19887High8.82026-09-05The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted…
CVE-2026-527772026-09-05YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserial…
CVE-2026-61686High7.52026-09-04SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unseri…
CVE-2026-19795Medium6.22026-09-03Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can tr…
CVE-2026-84834Critical9.82026-09-03Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
CVE-2026-84753Critical9.82026-09-03Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
CVE-2026-84752High8.82026-09-03Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
CVE-2026-848322026-09-03SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker…
CVE-2026-84670High8.82026-09-02Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance report…
CVE-2026-84650High8.82026-09-02In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuratio…
CVE-2026-84647High8.82026-09-02In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not r…
CVE-2026-84646Medium4.32026-09-02In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers wit…
CVE-2023-3360Low3.32026-09-02The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high…
CVE-2026-81772High8.82026-09-02Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.
CVE-2026-81283High8.82026-09-02Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
CVE-2026-19116High8.82026-09-02The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its…
CVE-2026-71981High8.82026-09-01Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplyi…
CVE-2026-72649High8.82026-09-01Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)…
CVE-2026-84202High8.82026-09-01ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Atta…
CVE-2026-61779High7.82026-09-01NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m…
CVE-2026-61778High7.82026-09-01NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m…