CWE-502 · Deserialization of Untrusted Data (page 3)
Page 3 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61777 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61776 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61775 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61774 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61773 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61772 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61771 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61770 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61769 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61768 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61767 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61766 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61765 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61764 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61763 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61762 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61761 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61760 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61759 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61758 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61757 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61756 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61755 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61754 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61753 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61752 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61751 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-61750 | High | 7.8 | 2026-09-01 | NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability m… |
CVE-2026-83557 | Medium | 5.6 | 2026-09-01 | DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom v… |
CVE-2026-82226 | Critical | 9.8 | 2026-08-31 | Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions. |
CVE-2026-83497 | High | 8.8 | 2026-08-31 | Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic re… |
CVE-2026-81319 | | 2026-08-30 | Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEA… | |
CVE-2026-76547 | Medium | 6.6 | 2026-08-29 | The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing hig… |
CVE-2026-55220 | | 2026-08-28 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspot… | |
CVE-2026-81757 | High | 7.2 | 2026-08-28 | Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions. |
CVE-2026-82259 | High | 7.5 | 2026-08-28 | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an app… |
CVE-2026-82222 | Critical | 10.0 | 2026-08-28 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. |
CVE-2026-78032 | Critical | 9.8 | 2026-08-28 | SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege. |
CVE-2026-14558 | High | 7.2 | 2026-08-28 | The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when renderi… |
CVE-2026-78614 | | 2026-08-28 | WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administr… | |
CVE-2026-78612 | | 2026-08-28 | WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report admin… | |
CVE-2026-59307 | High | 8.0 | 2026-08-27 | An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bea… |
CVE-2026-59306 | Low | 3.1 | 2026-08-27 | Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Strea… |
CVE-2026-59285 | High | 8.1 | 2026-08-27 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 |
CVE-2026-10036 | High | 8.8 | 2026-08-27 | SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml ch… |
CVE-2026-78292 | Critical | 9.8 | 2026-08-27 | Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions. |
CVE-2026-78286 | Critical | 9.8 | 2026-08-27 | Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions. |
CVE-2026-78276 | High | 7.2 | 2026-08-27 | Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-78257 | High | 8.8 | 2026-08-27 | Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions. |
CVE-2026-59275 | Medium | 6.6 | 2026-08-27 | A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload… |
CVE-2026-47878 | Medium | 5.6 | 2026-08-27 | DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject(… |
CVE-2026-47875 | Medium | 5.6 | 2026-08-27 | Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrus… |
CVE-2026-47864 | Medium | 6.4 | 2026-08-27 | SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with C… |
CVE-2026-47856 | Medium | 6.3 | 2026-08-27 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a cl… |
CVE-2026-51106 | Critical | 9.3 | 2026-08-26 | An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component |
CVE-2026-80428 | Critical | 9.8 | 2026-08-26 | ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arb… |
CVE-2026-51368 | Critical | 9.8 | 2026-08-25 | An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code vi… |
CVE-2026-79657 | Critical | 9.8 | 2026-08-25 | NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific… |
CVE-2026-77138 | | 2026-08-25 | The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attack… | |
CVE-2026-56095 | | 2026-08-25 | The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data f… | |
CVE-2026-78683 | Critical | 9.6 | 2026-08-25 | NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/trans… |
CVE-2026-78265 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions. |
CVE-2026-78262 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions. |
CVE-2026-32563 | Critical | 9.8 | 2026-08-24 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-40877 | High | 8.7 | 2026-08-24 | Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which… |
CVE-2026-76843 | High | 7.8 | 2026-08-24 | The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib… |
CVE-2026-66650 | Critical | 9.8 | 2026-08-24 | Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions. |
CVE-2026-78147 | High | 7.3 | 2026-08-23 | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp o… |
CVE-2026-0551 | High | 8.8 | 2026-08-23 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization o… |
CVE-2026-4703 | Critical | 9.8 | 2026-08-22 | The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 vi… |
CVE-2026-71513 | High | 8.8 | 2026-08-22 | NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, a… |
CVE-2026-54071 | High | 7.8 | 2026-08-21 | BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when… |
CVE-2026-77646 | | 2026-08-20 | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the d… | |
CVE-2026-77645 | | 2026-08-20 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deseria… | |
CVE-2026-69836 | Critical | 10.0 | 2026-08-20 | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. |
CVE-2026-18285 | High | 7.8 | 2026-08-20 | Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit… |
CVE-2026-15679 | High | 7.8 | 2026-08-20 | Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2026-73993 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. |
CVE-2026-66672 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. |
CVE-2026-66583 | Critical | 9.8 | 2026-08-20 | Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. |
CVE-2026-76850 | Critical | 9.8 | 2026-08-19 | LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-… |
CVE-2026-76404 | Critical | 9.1 | 2026-08-19 | In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. Th… |
CVE-2026-76395 | High | 8.8 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file c… |
CVE-2026-44901 | High | 8.4 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult… |
CVE-2026-49817 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access coul… |
CVE-2026-49816 | High | 7.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access coul… |
CVE-2026-73389 | Critical | 9.8 | 2026-08-19 | Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions. |
CVE-2026-73364 | Critical | 9.8 | 2026-08-19 | Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. |
CVE-2026-75987 | High | 7.3 | 2026-08-19 | A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/para… |
CVE-2026-60412 | High | 7.8 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is… |
CVE-2026-60392 | High | 7.8 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is a… |
CVE-2026-74012 | High | 8.8 | 2026-08-18 | Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0. |
CVE-2026-73397 | Critical | 9.8 | 2026-08-18 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. |
CVE-2026-73380 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. |
CVE-2026-73376 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. |
CVE-2026-73366 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. |
CVE-2026-73341 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. |
CVE-2026-66620 | High | 7.2 | 2026-08-18 | Editor PHP Object Injection in OptionTree <= 2.7.3 versions. |
CVE-2026-59940 | Critical | 9.8 | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attack… |
CVE-2026-32470 | Critical | 9.8 | 2026-08-18 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. |