CWE-502 · Deserialization of Untrusted Data (page 7)
Page 7 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71260 | High | 8.8 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlin… |
CVE-2026-25445 | High | 8.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a… |
CVE-2025-60237 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0. |
CVE-2025-60233 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2. |
CVE-2026-27096 | High | 8.1 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects Colo… |
CVE-2026-25873 | Critical | 9.8 | 2026-03-18 | OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary co… |
CVE-2026-25449 | Critical | 9.8 | 2026-03-18 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. |
CVE-2026-25769 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE)… |
CVE-2026-1323 | High | 8.8 | 2026-03-17 | The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted se… |
CVE-2025-54920 | High | 8.8 | 2026-03-16 | This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summ… |
CVE-2026-32355 | High | 8.8 | 2026-03-13 | Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8… |
CVE-2025-13913 | Medium | 6.3 | 2026-03-12 | A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code. |
CVE-2026-3989 | High | 7.8 | 2026-03-12 | SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by pr… |
CVE-2026-3060 | Critical | 9.8 | 2026-03-12 | SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes unt… |
CVE-2026-3059 | Critical | 9.8 | 2026-03-12 | SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pi… |
CVE-2026-3967 | Medium | 6.3 | 2026-03-12 | A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-co… |
CVE-2026-22248 | High | 8.0 | 2026-03-11 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0… |
CVE-2026-2626 | High | 8.1 | 2026-03-11 | The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to mod… |
CVE-2026-26114 | High | 8.8 | 2026-03-10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-25166 | High | 7.8 | 2026-03-10 | Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. |
CVE-2026-1286 | Medium | 6.5 | 2026-03-10 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2025-56422 | Critical | 9.8 | 2026-03-10 | A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server. |
CVE-2025-11739 | High | 7.8 | 2026-03-10 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authent… |
CVE-2026-27685 | Critical | 9.1 | 2026-03-10 | SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could resu… |
CVE-2026-2020 | High | 7.5 | 2026-03-07 | The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribu… |
CVE-2026-28277 | Medium | 6.8 | 2026-03-05 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and pr… |
CVE-2026-27749 | High | 7.8 | 2026-03-05 | Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.e… |
CVE-2026-2599 | Critical | 9.8 | 2026-03-05 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4… |
CVE-2026-28105 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <=… |
CVE-2026-28074 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <=… |
CVE-2026-27439 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5. |
CVE-2026-27438 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7. |
CVE-2026-27437 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a throu… |
CVE-2026-27417 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through <… |
CVE-2026-27379 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue af… |
CVE-2026-27369 | High | 8.1 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6. |
CVE-2026-27338 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7. |
CVE-2026-27098 | High | 8.1 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue aff… |
CVE-2026-24385 | High | 7.5 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web… |
CVE-2026-23798 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: f… |
CVE-2026-22501 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1… |
CVE-2026-22497 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2. |
CVE-2026-22475 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4. |
CVE-2026-22474 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: f… |
CVE-2026-22473 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through… |
CVE-2026-22471 | High | 8.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This i… |
CVE-2026-22454 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5. |
CVE-2026-22453 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3. |
CVE-2026-22451 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a throug… |
CVE-2026-22417 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a thr… |
CVE-2025-54001 | Critical | 9.8 | 2026-03-05 | Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5. |
CVE-2026-20131 | Critical | 10.0 | 2026-03-04 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker… |
CVE-2026-3452 | High | 7.2 | 2026-03-04 | Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parame… |
CVE-2026-27971 | Critical | 9.8 | 2026-03-03 | Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechan… |
CVE-2025-57622 | Critical | 9.8 | 2026-03-03 | An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) comp… |
CVE-2025-52998 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attack… |
CVE-2025-50198 | Medium | 4.9 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import… |
CVE-2024-47886 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within ver… |
CVE-2026-3422 | Critical | 9.8 | 2026-03-02 | U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on t… |
CVE-2026-2471 | High | 7.5 | 2026-02-28 | The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted in… |
CVE-2026-1542 | Medium | 6.5 | 2026-02-28 | The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection… |
CVE-2026-21619 | High | 7.5 | 2026-02-27 | Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang… |
CVE-2026-27776 | High | 8.8 | 2026-02-27 | IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on t… |
CVE-2026-3071 | High | 8.4 | 2026-02-26 | Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a m… |
CVE-2026-28138 | High | 7.2 | 2026-02-26 | Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0. |
CVE-2026-27830 | High | 8.0 | 2026-02-26 | c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Severa… |
CVE-2026-27794 | Medium | 6.6 | 2026-02-25 | LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph'… |
CVE-2026-27727 | Critical | 9.8 | 2026-02-25 | mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for rem… |
CVE-2026-26222 | Critical | 9.8 | 2026-02-24 | Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService… |
CVE-2026-21665 | | 2026-02-23 | The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 2021.2.4 (build 4.7.3155.0011) uses depre… | |
CVE-2026-25747 | High | 8.8 | 2026-02-23 | Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read fro… |
CVE-2026-2970 | Medium | 4.6 | 2026-02-23 | A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/r… |
CVE-2026-2898 | Medium | 5.5 | 2026-02-22 | A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the… |
CVE-2026-27206 | High | 8.1 | 2026-02-21 | Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects fr… |
CVE-2026-2037 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2026-2036 | High | 8.8 | 2026-02-20 | GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-24892 | High | 7.5 | 2026-02-20 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3… |
CVE-2026-24891 | High | 7.5 | 2026-02-20 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an… |
CVE-2026-22384 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in leafcolor Applay - Shortcodes applay-shortcodes allows Object Injection.This issue affects Applay - Shortcod… |
CVE-2026-22354 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.Th… |
CVE-2026-22346 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow allows O… |
CVE-2026-22345 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allo… |
CVE-2025-69405 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue… |
CVE-2025-69404 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a throu… |
CVE-2025-69382 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in themesflat Themesflat Elementor themesflat-elementor allows Object Injection.This issue affects Themesflat E… |
CVE-2025-69372 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <… |
CVE-2025-69371 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in AncoraThemes KindlyCare kindlycare allows Object Injection.This issue affects KindlyCare: from n/a through <… |
CVE-2025-69370 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5. |
CVE-2025-69329 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1. |
CVE-2025-69328 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection… |
CVE-2025-69301 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11. |
CVE-2025-69294 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from n/a through <= 1.5… |
CVE-2025-68853 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a t… |
CVE-2025-68541 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0. |
CVE-2025-68531 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injecti… |
CVE-2025-68526 | High | 8.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n… |
CVE-2025-67997 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a throu… |
CVE-2025-67996 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6. |
CVE-2025-67995 | Critical | 9.8 | 2026-02-20 | Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1. |
CVE-2026-27475 | High | 8.1 | 2026-02-19 | SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An at… |