CWE-502 · Deserialization of Untrusted Data (page 4)
Page 4 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39573 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. |
CVE-2026-39567 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. |
CVE-2026-39557 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. |
CVE-2026-39554 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. |
CVE-2026-39545 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. |
CVE-2026-39539 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions. |
CVE-2026-39529 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. |
CVE-2026-39446 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions. |
CVE-2026-39443 | High | 8.1 | 2026-06-17 | Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. |
CVE-2026-27429 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. |
CVE-2026-27410 | Medium | 6.5 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
CVE-2026-12256 | High | 8.8 | 2026-06-17 | Contributor PHP Object Injection in Avada <= 3.15.3 versions. |
CVE-2026-12115 | Medium | 6.6 | 2026-06-17 | The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… |
CVE-2026-11857 | | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remo… | |
CVE-2025-69122 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions. |
CVE-2025-69108 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions. |
CVE-2025-60205 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions. |
CVE-2026-35300 | Critical | 9.8 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 1… |
CVE-2026-48775 | Medium | 6.8 | 2026-06-16 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and p… |
CVE-2026-10748 | | 2026-06-16 | An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the… | |
CVE-2026-24228 | High | 7.8 | 2026-06-16 | NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerabil… |
CVE-2026-48853 | | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers… | |
CVE-2026-9691 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. |
CVE-2026-49781 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. |
CVE-2026-49770 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions. |
CVE-2026-49769 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. |
CVE-2026-49768 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions. |
CVE-2026-49765 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions. |
CVE-2026-49763 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions. |
CVE-2026-49109 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions. |
CVE-2026-49106 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions. |
CVE-2026-49105 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. |
CVE-2026-49104 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions. |
CVE-2026-49085 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions. |
CVE-2026-42687 | High | 8.1 | 2026-06-15 | Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions. |
CVE-2026-39532 | High | 8.8 | 2026-06-15 | Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions. |
CVE-2026-39499 | High | 7.2 | 2026-06-15 | Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions. |
CVE-2026-39498 | High | 7.2 | 2026-06-15 | Shop manager PHP Object Injection in YayMail <= 4.3.3 versions. |
CVE-2026-39481 | High | 7.2 | 2026-06-15 | Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. |
CVE-2026-39478 | High | 8.8 | 2026-06-15 | Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions. |
CVE-2026-39474 | High | 8.8 | 2026-06-15 | Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. |
CVE-2026-39472 | High | 7.2 | 2026-06-15 | Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions. |
CVE-2026-39471 | High | 7.2 | 2026-06-15 | Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. |
CVE-2026-39434 | High | 7.2 | 2026-06-15 | Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. |
CVE-2026-27333 | High | 8.1 | 2026-06-15 | Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. |
CVE-2026-27053 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. |
CVE-2026-39006 | Critical | 9.8 | 2026-06-15 | An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. |
CVE-2026-11860 | | 2026-06-15 | Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with seria… | |
CVE-2026-12191 | High | 7.8 | 2026-06-14 | A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the co… |
CVE-2026-50633 | High | 8.1 | 2026-06-12 | A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipu… |
CVE-2026-50632 | High | 8.1 | 2026-06-12 | A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can all… |
CVE-2026-41699 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL r… |
CVE-2026-20251 | High | 8.8 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3… |
CVE-2026-53435 | High | 8.8 | 2026-06-10 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plug… |
CVE-2026-52751 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code e… |
CVE-2026-10721 | | 2026-06-10 | Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components. An unauthenticated… | |
CVE-2026-11815 | | 2026-06-10 | An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects… | |
CVE-2026-41732 | High | 8.1 | 2026-06-10 | JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subp… |
CVE-2026-41731 | High | 8.1 | 2026-06-10 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any… |
CVE-2026-40993 | High | 7.3 | 2026-06-10 | An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store… |
CVE-2026-44963 | | 2026-06-09 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. | |
CVE-2026-48560 | Medium | 5.4 | 2026-06-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-45484 | High | 8.8 | 2026-06-09 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26142 | Critical | 9.8 | 2026-06-09 | Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network. |
CVE-2026-49740 | | 2026-06-09 | TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restriction… | |
CVE-2026-8365 | High | 8.8 | 2026-06-09 | The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 datab… |
CVE-2026-41855 | High | 8.1 | 2026-06-09 | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.Jackso… |
CVE-2026-7566 | Medium | 6.6 | 2026-06-06 | The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserializa… |
CVE-2026-7654 | High | 8.8 | 2026-06-05 | The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is d… |
CVE-2026-50589 | Medium | 5.3 | 2026-06-05 | In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and… |
CVE-2026-25551 | High | 7.8 | 2026-06-04 | Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privile… |
CVE-2026-25550 | Critical | 9.8 | 2026-06-04 | Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port… |
CVE-2026-50076 | Critical | 9.1 | 2026-06-04 | Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacke… |
CVE-2026-7888 | | 2026-06-03 | Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allow… | |
CVE-2026-47065 | Critical | 9.8 | 2026-06-03 | ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised str… |
CVE-2026-42211 | High | 8.1 | 2026-06-02 | React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized re… |
CVE-2026-34993 | Medium | 6.4 | 2026-06-02 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may al… |
CVE-2026-24237 | High | 7.8 | 2026-06-02 | NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability… |
CVE-2026-24221 | High | 7.8 | 2026-06-02 | NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability… |
CVE-2026-39555 | High | 8.1 | 2026-06-02 | Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1. |
CVE-2026-39551 | High | 8.1 | 2026-06-02 | Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1. |
CVE-2026-39550 | High | 8.1 | 2026-06-02 | Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6. |
CVE-2026-10566 | Medium | 5.3 | 2026-06-02 | A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check_instruct_content of the file metagpt/schema.py… |
CVE-2026-9330 | High | 8.5 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign… |
CVE-2026-9319 | Critical | 9.0 | 2026-06-01 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints wi… |
CVE-2026-49121 | High | 8.1 | 2026-06-01 | AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm… |
CVE-2026-38950 | High | 7.8 | 2026-06-01 | An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model file… |
CVE-2026-10532 | | 2026-06-01 | Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection… | |
CVE-2026-7858 | Critical | 9.8 | 2026-06-01 | A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration S… |
CVE-2026-45360 | High | 7.3 | 2026-06-01 | Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imported and dispatched arbitrary class paths dr… |
CVE-2026-42359 | High | 8.8 | 2026-06-01 | A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` allowed an authenticated UI/API user with XCom write permission on a Dag to set… |
CVE-2026-10042 | Critical | 9.8 | 2026-05-29 | manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in t… |
CVE-2025-11993 | High | 8.8 | 2026-05-29 | The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via th… |
CVE-2026-9828 | | 2026-05-28 | Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection… | |
CVE-2026-37579 | High | 7.3 | 2026-05-28 | An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java component |
CVE-2026-47161 | | 2026-05-27 | RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configures its Celery workers to accept and dese… | |
CVE-2026-45134 | High | 7.1 | 2026-05-27 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's promp… |
CVE-2026-48919 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-48917 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. |
CVE-2026-44843 | High | 8.2 | 2026-05-26 | LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserial… |