CWE-502 · Deserialization of Untrusted Data (page 2)
Page 2 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15962 | High | 8.8 | 2026-07-26 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of… |
CVE-2026-50517 | Critical | 9.9 | 2026-07-24 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. |
CVE-2026-21655 | | 2026-07-23 | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Serv… | |
CVE-2026-65497 | High | 7.2 | 2026-07-23 | Administrator PHP Object Injection in Complianz <= 7.5.0 versions. |
CVE-2026-65493 | High | 7.5 | 2026-07-23 | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. |
CVE-2026-59544 | Critical | 9.8 | 2026-07-23 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. |
CVE-2026-16723 | Critical | 9.0 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configur… |
CVE-2026-61246 | High | 8.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60439 | High | 8.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60373 | High | 8.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60372 | Critical | 9.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60369 | Critical | 9.9 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60367 | Critical | 9.8 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-60366 | Critical | 10.0 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that a… |
CVE-2026-13190 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from atta… |
CVE-2026-13185 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-… |
CVE-2026-47058 | High | 7.4 | 2026-07-21 | Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to… |
CVE-2026-24232 | Medium | 4.3 | 2026-07-21 | NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerab… |
CVE-2026-64606 | Critical | 9.8 | 2026-07-21 | Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture… |
CVE-2026-64608 | Critical | 9.8 | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not… |
CVE-2026-63767 | Critical | 9.8 | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute… |
CVE-2026-28220 | High | 8.4 | 2026-07-20 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (D… |
CVE-2026-12484 | High | 7.8 | 2026-07-19 | A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.To… |
CVE-2026-8476 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses… |
CVE-2026-45162 | High | 8.0 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data… |
CVE-2026-14890 | Critical | 9.1 | 2026-07-16 | SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deser… |
CVE-2026-15008 | High | 8.1 | 2026-07-16 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to i… |
CVE-2026-47472 | High | 7.8 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization… |
CVE-2026-24233 | High | 8.4 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attack… |
CVE-2026-24227 | Medium | 5.3 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lea… |
CVE-2026-24220 | Medium | 6.4 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zer… |
CVE-2026-50649 | High | 7.8 | 2026-07-14 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-50646 | High | 7.8 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
CVE-2026-55944 | Critical | 9.8 | 2026-07-14 | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network. |
CVE-2026-50509 | High | 7.8 | 2026-07-14 | Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-45077 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log l… |
CVE-2026-58644 | Critical | 9.8 | 2026-07-14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-55009 | High | 7.8 | 2026-07-14 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-54118 | High | 8.8 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-54117 | High | 8.8 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-50652 | High | 7.5 | 2026-07-14 | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-50522 | Critical | 9.8 | 2026-07-14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-12583 | High | 8.1 | 2026-07-14 | The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated… |
CVE-2026-58233 | High | 7.6 | 2026-07-14 | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by th… |
CVE-2026-59521 | High | 7.2 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimon… |
CVE-2026-59518 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8… |
CVE-2026-57770 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography… |
CVE-2026-57744 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Ext… |
CVE-2026-57738 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0. |
CVE-2026-57724 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12. |
CVE-2026-57713 | High | 8.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager… |
CVE-2026-57371 | High | 8.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <=… |
CVE-2026-15535 | Medium | 6.3 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize… |
CVE-2026-15531 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.loa… |
CVE-2026-15529 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performi… |
CVE-2026-58281 | High | 8.3 | 2026-07-11 | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-55175 | High | 7.5 | 2026-07-10 | Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release… |
CVE-2026-44795 | High | 8.8 | 2026-07-10 | Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses saf… |
CVE-2026-54469 | High | 8.8 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote… |
CVE-2026-59827 | Critical | 9.9 | 2026-07-09 | Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2… |
CVE-2026-54499 | High | 7.5 | 2026-07-08 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loader… |
CVE-2026-33264 | Critical | 9.8 | 2026-07-07 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a s… |
CVE-2026-43825 | High | 7.3 | 2026-07-06 | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in O… |
CVE-2026-46590 | High | 8.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-43867 | Critical | 9.8 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) throug… |
CVE-2026-43866 | High | 7.3 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent… |
CVE-2026-43865 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances usi… |
CVE-2026-42527 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defens… |
CVE-2026-40859 | High | 8.1 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type ap… |
CVE-2026-14723 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component… |
CVE-2026-14637 | High | 8.2 | 2026-07-04 | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element… |
CVE-2026-14534 | High | 8.8 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_… |
CVE-2025-71375 | High | 8.1 | 2026-07-04 | picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malici… |
CVE-2025-71372 | High | 8.1 | 2026-07-04 | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attacke… |
CVE-2025-71369 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing att… |
CVE-2025-71367 | High | 8.1 | 2026-07-04 | picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers… |
CVE-2025-71366 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass sa… |
CVE-2025-71364 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execut… |
CVE-2025-71362 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed mali… |
CVE-2025-71360 | High | 8.1 | 2026-07-04 | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected cod… |
CVE-2025-71359 | High | 8.1 | 2026-07-04 | picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code… |
CVE-2025-71356 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. At… |
CVE-2025-71353 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can cr… |
CVE-2025-71347 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypa… |
CVE-2025-71345 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed und… |
CVE-2025-71343 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attac… |
CVE-2025-71342 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in p… |
CVE-2026-12481 | Critical | 9.8 | 2026-07-03 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Speci… |
CVE-2026-13371 | Medium | 4.9 | 2026-07-03 | An authenticated administrator can trigger a denial-of-service condition in the Fireware Management Web UI by sending malformed or crafted data to the put_data… |
CVE-2026-57677 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. |
CVE-2026-57621 | Critical | 9.8 | 2026-07-02 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. |
CVE-2026-56037 | High | 8.8 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3. |
CVE-2026-27414 | High | 8.8 | 2026-07-02 | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. |
CVE-2026-27060 | High | 8.8 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a… |
CVE-2026-55153 | High | 7.1 | 2026-07-01 | mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI Objec… |
CVE-2026-14265 | High | 7.5 | 2026-07-01 | Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with… |
CVE-2026-51947 | Critical | 9.8 | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a… |
CVE-2026-57516 | High | 8.8 | 2026-07-01 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplyi… |
CVE-2026-58127 | Critical | 9.8 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemot… |
CVE-2026-58126 | Critical | 9.8 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by expl… |