CWE-502 · Deserialization of Untrusted Data (page 5)
Page 5 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24162 | High | 7.8 | 2026-05-26 | NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of th… |
CVE-2026-45247 | Critical | 9.8 | 2026-05-26 | Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to ach… |
CVE-2026-9497 | Medium | 6.3 | 2026-05-25 | A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST… |
CVE-2026-4372 | High | 7.8 | 2026-05-24 | A critical remote code execution vulnerability exists in all versions of the HuggingFace transformers library prior to version 5.3.0. The vulnerability allows… |
CVE-2026-45659 | High | 8.8 | 2026-05-22 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-41104 | Critical | 10.0 | 2026-05-22 | Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. |
CVE-2026-9291 | High | 7.1 | 2026-05-22 | Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write acce… |
CVE-2026-39832 | Critical | 9.1 | 2026-05-22 | When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrict… |
CVE-2026-8135 | High | 7.2 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rog… |
CVE-2026-48207 | Critical | 9.8 | 2026-05-21 | Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce… |
CVE-2026-24216 | High | 7.8 | 2026-05-20 | NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability migh… |
CVE-2026-7637 | Critical | 9.8 | 2026-05-20 | The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYX… |
CVE-2026-24163 | High | 7.5 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this… |
CVE-2026-24142 | Medium | 6.3 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead… |
CVE-2025-33255 | High | 7.5 | 2026-05-20 | NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this v… |
CVE-2026-6009 | | 2026-05-19 | Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution on the affected syst… | |
CVE-2026-31072 | Critical | 9.8 | 2026-05-19 | The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Des… |
CVE-2025-51427 | High | 7.3 | 2026-05-19 | An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) u… |
CVE-2026-43633 | Critical | 10.0 | 2026-05-19 | HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and… |
CVE-2026-8727 | | 2026-05-19 | The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint… | |
CVE-2026-46725 | | 2026-05-19 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can… | |
CVE-2026-33233 | High | 7.6 | 2026-05-19 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, t… |
CVE-2026-26978 | | 2026-05-18 | FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentiall… | |
CVE-2026-45829 | Critical | 10.0 | 2026-05-18 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary… |
CVE-2026-7304 | Critical | 9.8 | 2026-05-18 | SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Pyt… |
CVE-2026-7301 | Critical | 9.8 | 2026-05-18 | SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages… |
CVE-2026-8751 | High | 7.3 | 2026-05-17 | A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of… |
CVE-2026-8735 | Medium | 6.3 | 2026-05-17 | A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component… |
CVE-2021-47952 | Critical | 9.8 | 2026-05-16 | python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JS… |
CVE-2026-8612 | Medium | 5.3 | 2026-05-15 | WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and… |
CVE-2026-44501 | Medium | 4.3 | 2026-05-14 | DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlled Java objects from… |
CVE-2026-1184 | Medium | 6.5 | 2026-05-14 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allo… |
CVE-2026-41957 | High | 8.8 | 2026-05-13 | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versio… |
CVE-2026-7635 | High | 8.1 | 2026-05-13 | The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0. This is… |
CVE-2026-34659 | Critical | 9.6 | 2026-05-12 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2026-40368 | High | 8.0 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-40357 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-35439 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-33112 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-33110 | High | 8.8 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-31239 | Critical | 9.8 | 2026-05-12 | The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The Mam… |
CVE-2026-31238 | Critical | 9.8 | 2026-05-12 | The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component. When starting a model server with the ludw… |
CVE-2026-31237 | Critical | 9.8 | 2026-05-12 | The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method. When a user provides a dataset file path to… |
CVE-2026-31235 | Critical | 9.8 | 2026-05-12 | The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module. The class use… |
CVE-2026-31234 | Critical | 9.8 | 2026-05-12 | Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed… |
CVE-2026-31232 | High | 8.8 | 2026-05-12 | The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its mod… |
CVE-2026-31229 | Critical | 9.8 | 2026-05-12 | The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading fun… |
CVE-2026-31224 | High | 8.8 | 2026-05-12 | The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier.load() method of the MultitaskClassifi… |
CVE-2026-31223 | High | 8.8 | 2026-05-12 | The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of the BaseLabeler class… |
CVE-2026-31222 | High | 8.8 | 2026-05-12 | The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer class. The method loa… |
CVE-2026-31221 | High | 7.8 | 2026-05-12 | PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModu… |
CVE-2026-31219 | High | 8.8 | 2026-05-12 | The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vu… |
CVE-2026-31218 | High | 8.8 | 2026-05-12 | The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vu… |
CVE-2026-31214 | Critical | 9.8 | 2026-05-12 | The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deseri… |
CVE-2026-3048 | | 2026-05-11 | An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to init… | |
CVE-2026-31253 | High | 7.3 | 2026-05-11 | The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CW… |
CVE-2026-31250 | High | 7.3 | 2026-05-11 | CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.p… |
CVE-2026-31249 | High | 7.3 | 2026-05-11 | CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its make_parquet_li… |
CVE-2026-7818 | High | 7.0 | 2026-05-11 | Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file conten… |
CVE-2026-41486 | High | 8.8 | 2026-05-08 | Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arr… |
CVE-2026-44126 | | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which can be reached from the new GINA UI and may allow unauthentic… | |
CVE-2026-5127 | High | 8.8 | 2026-05-08 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization o… |
CVE-2025-69690 | Critical | 9.1 | 2026-05-08 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_command… |
CVE-2024-53326 | High | 7.3 | 2026-05-08 | LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution. |
CVE-2026-41586 | | 2026-05-07 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, C… | |
CVE-2026-34084 | Critical | 9.8 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through… |
CVE-2026-42027 | Critical | 9.8 | 2026-05-04 | Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Des… |
CVE-2026-7712 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation lead… |
CVE-2026-7647 | High | 8.1 | 2026-05-02 | The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's… |
CVE-2026-7597 | Medium | 6.3 | 2026-05-01 | A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a… |
CVE-2026-42473 | Critical | 9.8 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the F… |
CVE-2026-42472 | Critical | 9.8 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandl… |
CVE-2026-42471 | High | 8.1 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data received from… |
CVE-2026-37552 | High | 8.4 | 2026-05-01 | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it… |
CVE-2026-42779 | Critical | 9.8 | 2026-05-01 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer… |
CVE-2026-42778 | Critical | 9.8 | 2026-05-01 | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache M… |
CVE-2026-7584 | High | 7.8 | 2026-05-01 | The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically import and instantiate Python classes during deserialization. P… |
CVE-2026-42521 | Medium | 6.5 | 2026-04-29 | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration… |
CVE-2026-7317 | Medium | 5.0 | 2026-04-28 | A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/… |
CVE-2026-24186 | High | 8.8 | 2026-04-28 | NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message… |
CVE-2025-60889 | Critical | 9.8 | 2026-04-28 | Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecif… |
CVE-2025-60887 | Medium | 5.3 | 2026-04-28 | An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addres… |
CVE-2026-27172 | High | 8.8 | 2026-04-27 | The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)… |
CVE-2026-41409 | Critical | 9.8 | 2026-04-27 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applie… |
CVE-2026-40858 | High | 8.8 | 2026-04-27 | The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInpu… |
CVE-2026-33454 | Critical | 9.4 | 2026-04-27 | The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) on… |
CVE-2026-41635 | Critical | 9.8 | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypas… |
CVE-2026-40860 | Critical | 9.8 | 2026-04-27 | JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values… |
CVE-2026-40473 | High | 8.8 | 2026-04-27 | The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInp… |
CVE-2026-40048 | High | 7.8 | 2026-04-27 | The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStre… |
CVE-2025-62233 | Medium | 6.3 | 2026-04-24 | Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3… |
CVE-2026-41316 | High | 8.1 | 2026-04-24 | ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result`… |
CVE-2026-33819 | Critical | 10.0 | 2026-04-23 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. |
CVE-2026-26210 | Critical | 9.8 | 2026-04-23 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTE… |
CVE-2026-25874 | Critical | 9.8 | 2026-04-23 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data receive… |
CVE-2025-62373 | Critical | 9.8 | 2026-04-23 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerabili… |
CVE-2026-6857 | High | 7.5 | 2026-04-22 | A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker wi… |
CVE-2026-6023 | High | 8.1 | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filte… |
CVE-2026-22016 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions… |
CVE-2026-39467 | High | 7.2 | 2026-04-21 | Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by M… |