CWE-502 · Deserialization of Untrusted Data (page 3)
Page 3 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58025 | Critical | 9.8 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiIm… |
CVE-2026-24251 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful ex… |
CVE-2026-24250 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vul… |
CVE-2026-24247 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24245 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24244 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24243 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-24240 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnera… |
CVE-2026-10538 | High | 8.0 | 2026-07-01 | Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Co… |
CVE-2026-56700 | Critical | 9.8 | 2026-06-30 | Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapte… |
CVE-2026-55223 | | 2026-06-30 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization… | |
CVE-2025-71374 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arb… |
CVE-2025-71371 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payload… |
CVE-2025-71368 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote at… |
CVE-2025-71363 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers c… |
CVE-2025-71350 | High | 8.1 | 2026-06-30 | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected co… |
CVE-2025-71349 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious co… |
CVE-2026-7871 | Critical | 9.8 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data… |
CVE-2026-13759 | High | 7.5 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, Object… |
CVE-2026-12578 | | 2026-06-30 | The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code. | |
CVE-2026-12240 | High | 8.0 | 2026-06-30 | The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-57527 | High | 8.8 | 2026-06-26 | Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web ser… |
CVE-2026-56057 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. |
CVE-2026-56055 | High | 8.8 | 2026-06-26 | Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. |
CVE-2026-56032 | Critical | 9.8 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. |
CVE-2026-56031 | High | 8.1 | 2026-06-26 | Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. |
CVE-2026-53914 | Medium | 6.7 | 2026-06-26 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata |
CVE-2025-71340 | High | 8.1 | 2026-06-25 | picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can e… |
CVE-2026-46607 | High | 7.8 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stor… |
CVE-2026-56053 | High | 8.8 | 2026-06-25 | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. |
CVE-2026-10043 | High | 7.8 | 2026-06-24 | MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-56121 | Critical | 9.8 | 2026-06-24 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by… |
CVE-2025-71354 | High | 8.1 | 2026-06-24 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can… |
CVE-2026-54512 | High | 8.1 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4… |
CVE-2026-41862 | High | 8.8 | 2026-06-23 | Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a clas… |
CVE-2026-39253 | High | 8.1 | 2026-06-23 | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conve… |
CVE-2025-71376 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embe… |
CVE-2025-71370 | High | 8.1 | 2026-06-23 | picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft ma… |
CVE-2025-71365 | High | 8.1 | 2026-06-23 | picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can cr… |
CVE-2025-71341 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code… |
CVE-2026-48517 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializer… |
CVE-2026-48502 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attac… |
CVE-2025-71358 | High | 8.1 | 2026-06-22 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers… |
CVE-2025-71344 | High | 8.1 | 2026-06-22 | picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing a… |
CVE-2025-71339 | High | 8.1 | 2026-06-22 | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attac… |
CVE-2026-45034 | | 2026-06-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrapper… | |
CVE-2025-71378 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious… |
CVE-2025-71357 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed und… |
CVE-2025-71348 | High | 8.1 | 2026-06-21 | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers ca… |
CVE-2026-12787 | Medium | 6.3 | 2026-06-21 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnecti… |
CVE-2026-56304 | Medium | 6.5 | 2026-06-20 | picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logg… |
CVE-2026-48909 | | 2026-06-20 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute ar… | |
CVE-2026-49286 | High | 8.1 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output file… |
CVE-2026-12046 | Critical | 9.0 | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connecti… |
CVE-2025-27511 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an ad… |
CVE-2026-8024 | Critical | 9.8 | 2026-06-18 | A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affe… |
CVE-2026-12569 | Critical | 9.8 | 2026-06-18 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the… |
CVE-2026-53805 | Critical | 9.8 | 2026-06-17 | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-in… |
CVE-2026-53874 | Critical | 9.8 | 2026-06-17 | picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested u… |
CVE-2025-71321 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util… |
CVE-2026-49108 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. |
CVE-2026-40757 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. |
CVE-2026-40756 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. |
CVE-2026-40752 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. |
CVE-2026-40738 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. |
CVE-2026-40733 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. |
CVE-2026-39576 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. |
CVE-2026-39560 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. |
CVE-2026-39556 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. |
CVE-2026-39445 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. |
CVE-2026-39442 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. |
CVE-2025-69130 | High | 8.8 | 2026-06-17 | Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions. |
CVE-2025-69127 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions. |
CVE-2025-69111 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions. |
CVE-2025-60236 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5. |
CVE-2025-60231 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8… |
CVE-2025-60230 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9. |
CVE-2025-60229 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0. |
CVE-2026-54806 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |
CVE-2026-54194 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. |
CVE-2026-52706 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. |
CVE-2026-49107 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. |
CVE-2026-49075 | Critical | 9.8 | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. |
CVE-2026-42380 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. |
CVE-2026-40761 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. |
CVE-2026-40760 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. |
CVE-2026-40759 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. |
CVE-2026-40758 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. |
CVE-2026-40755 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. |
CVE-2026-40754 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. |
CVE-2026-40753 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. |
CVE-2026-40751 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. |
CVE-2026-40739 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. |
CVE-2026-40736 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. |
CVE-2026-40735 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. |
CVE-2026-40725 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. |
CVE-2026-39580 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. |
CVE-2026-39578 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. |
CVE-2026-39577 | Medium | 5.5 | 2026-06-17 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. |