CWE-502 · Deserialization of Untrusted Data (page 8)
Page 8 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25316 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through… |
CVE-2026-23549 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-23544 | High | 8.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5. |
CVE-2026-23542 | Critical | 9.8 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: fro… |
CVE-2026-22333 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH W… |
CVE-2025-15579 | | 2026-02-18 | Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection. The vulnerability could lead to remote code executio… | |
CVE-2026-1426 | High | 8.8 | 2026-02-18 | The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization… |
CVE-2025-60038 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60037 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated… |
CVE-2025-60036 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-60035 | High | 7.8 | 2026-02-18 | A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw… |
CVE-2025-33253 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by convincing a user to load a maliciously crafted file. A s… |
CVE-2025-33252 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33245 | High | 8.0 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution. A successful exploit of this vulnerability might lead to… |
CVE-2025-33243 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution in distributed environments. A successful exploit of this vu… |
CVE-2025-33241 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution by loading a maliciously crafted file. A successful exploit… |
CVE-2026-26220 | | 2026-02-17 | LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node… | |
CVE-2026-2555 | Medium | 5.0 | 2026-02-16 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/contro… |
CVE-2026-26333 | Critical | 9.8 | 2026-02-13 | Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (inc… |
CVE-2026-26208 | High | 7.8 | 2026-02-13 | ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Executio… |
CVE-2026-26221 | Critical | 9.8 | 2026-02-13 | Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can… |
CVE-2025-61880 | High | 8.8 | 2026-02-12 | In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution. |
CVE-2026-26215 | | 2026-02-11 | manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability that can lead to unauthenticated remote c… | |
CVE-2025-69872 | Critical | 9.8 | 2026-02-11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve ar… |
CVE-2026-0910 | High | 8.8 | 2026-02-11 | The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input… |
CVE-2026-1235 | Medium | 6.5 | 2026-02-11 | The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Inject… |
CVE-2026-21531 | Critical | 9.8 | 2026-02-10 | Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network. |
CVE-2026-21511 | High | 7.5 | 2026-02-10 | Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-23685 | Medium | 4.4 | 2026-02-10 | Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially c… |
CVE-2026-25925 | High | 7.8 | 2026-02-09 | PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it… |
CVE-2026-25923 | Critical | 9.1 | 2026-02-09 | my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to fi… |
CVE-2026-2113 | High | 7.3 | 2026-02-07 | A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0… |
CVE-2026-25632 | Critical | 10.0 | 2026-02-06 | EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EP… |
CVE-2020-37071 | Critical | 9.8 | 2026-02-03 | CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted pa… |
CVE-2026-25615 | High | 7.2 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668. |
CVE-2026-25614 | High | 7.5 | 2026-02-03 | Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680. |
CVE-2025-70560 | High | 8.4 | 2026-02-03 | Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecul… |
CVE-2025-70559 | Medium | 6.5 | 2026-02-03 | pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CM… |
CVE-2026-24954 | High | 8.8 | 2026-02-03 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2026-1691 | Medium | 6.3 | 2026-01-30 | A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/Backu… |
CVE-2025-61140 | Critical | 9.8 | 2026-01-28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
CVE-2025-40553 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40551 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2026-24765 | High | 7.8 | 2026-01-27 | PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe… |
CVE-2026-24747 | High | 8.8 | 2026-01-27 | PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker… |
CVE-2026-24815 | | 2026-01-27 | Unrestricted Upload of File with Dangerous Type, Deserialization of Untrusted Data vulnerability in datavane tis (tis-plugin/src/main/java/com/qlangtech/tis/ex… | |
CVE-2026-23864 | High | 7.5 | 2026-01-26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbop… |
CVE-2026-24656 | Low | 3.7 | 2026-01-26 | Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If… |
CVE-2026-0773 | Critical | 9.8 | 2026-01-23 | Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0772 | High | 7.5 | 2026-01-23 | Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0764 | Critical | 9.8 | 2026-01-23 | GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-0763 | Critical | 9.8 | 2026-01-23 | GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers t… |
CVE-2026-0762 | High | 8.1 | 2026-01-23 | GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-0760 | Critical | 9.8 | 2026-01-23 | Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-15351 | High | 7.8 | 2026-01-23 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-15350 | High | 7.8 | 2026-01-23 | Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-15348 | High | 7.8 | 2026-01-23 | Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-69099 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5. |
CVE-2025-69079 | Critical | 9.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Soun… |
CVE-2025-69036 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n… |
CVE-2025-69035 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT… |
CVE-2025-69002 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9. |
CVE-2025-68903 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0. |
CVE-2025-68899 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4. |
CVE-2025-68047 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <=… |
CVE-2025-67619 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through… |
CVE-2025-67617 | Critical | 9.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <=… |
CVE-2025-50004 | High | 8.8 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a throu… |
CVE-2026-24009 | High | 8.1 | 2026-01-22 | Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related R… |
CVE-2026-23946 | Medium | 6.8 | 2026-01-22 | Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical d… |
CVE-2026-23737 | High | 7.5 | 2026-01-21 | seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input hand… |
CVE-2026-23524 | Critical | 9.8 | 2026-01-21 | Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. In versions 1.6.3 and below, Reverb passes data from the Redis ch… |
CVE-2025-56005 | Critical | 9.8 | 2026-01-20 | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()`… |
CVE-2026-0726 | High | 8.1 | 2026-01-20 | The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via des… |
CVE-2026-0895 | | 2026-01-20 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/… | |
CVE-2023-7334 | Critical | 9.8 | 2026-01-15 | Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A… |
CVE-2026-23746 | | 2026-01-15 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2026-21226 | High | 7.5 | 2026-01-13 | Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. |
CVE-2026-20963 | Critical | 9.8 | 2026-01-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-0859 | High | 7.8 | 2026-01-13 | TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the m… |
CVE-2024-14021 | High | 7.8 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_… |
CVE-2025-69276 | High | 8.8 | 2026-01-12 | Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum… |
CVE-2026-22612 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. T… |
CVE-2026-22609 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag s… |
CVE-2026-22608 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other exist… |
CVE-2026-22607 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Beca… |
CVE-2026-22606 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because… |
CVE-2025-67911 | Critical | 9.8 | 2026-01-08 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from… |
CVE-2026-22187 | High | 7.8 | 2026-01-07 | Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image proces… |
CVE-2025-47552 | Critical | 9.8 | 2026-01-07 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a… |
CVE-2025-47553 | High | 8.8 | 2026-01-06 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a… |
CVE-2025-31047 | High | 8.8 | 2026-01-05 | Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0. |
CVE-2025-15453 | Medium | 6.3 | 2026-01-05 | A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the co… |
CVE-2025-15438 | Medium | 4.7 | 2026-01-02 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Me… |
CVE-2025-11157 | High | 7.8 | 2026-01-01 | A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast… |
CVE-2025-15276 | High | 7.8 | 2025-12-31 | FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15375 | Medium | 6.3 | 2025-12-31 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
CVE-2025-15246 | Medium | 6.3 | 2025-12-30 | A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the compo… |
CVE-2025-15222 | Medium | 5.0 | 2025-12-30 | A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateF… |
CVE-2025-15117 | Low | 3.1 | 2025-12-28 | A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Execu… |