CWE-502 · Deserialization of Untrusted Data (page 9)
Page 9 of 34 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33858 | High | 8.8 | 2026-04-13 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code… |
CVE-2026-1462 | High | 7.8 | 2026-04-13 | A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserial… |
CVE-2026-35337 | High | 8.8 | 2026-04-13 | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitte… |
CVE-2026-25204 | Medium | 6.2 | 2026-04-13 | Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue a… |
CVE-2026-5507 | Medium | 4.0 | 2026-04-09 | When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the… |
CVE-2026-3199 | High | 8.8 | 2026-04-08 | A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creatio… |
CVE-2026-39890 | Critical | 9.8 | 2026-04-08 | PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disab… |
CVE-2026-23869 | High | 7.5 | 2026-04-08 | A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and… |
CVE-2026-32590 | High | 7.1 | 2026-04-08 | A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a for… |
CVE-2026-3296 | Critical | 9.8 | 2026-04-08 | The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input… |
CVE-2026-3357 | High | 8.8 | 2026-04-08 | IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default sett… |
CVE-2026-33439 | Critical | 9.8 | 2026-04-07 | Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code… |
CVE-2026-39324 | Critical | 9.8 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c… |
CVE-2026-24156 | High | 7.3 | 2026-04-07 | NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead t… |
CVE-2026-35464 | High | 7.5 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from m… |
CVE-2026-1839 | High | 7.8 | 2026-04-07 | A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` meth… |
CVE-2026-35171 | Critical | 9.8 | 2026-04-06 | Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDRO_LOGGING_CONFIG e… |
CVE-2026-5659 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx… |
CVE-2026-5536 | High | 7.3 | 2026-04-05 | A weakness has been identified in FedML-AI FedML up to 0.8.9. Affected is the function sendMessage of the file grpc_server.py of the component gRPC server. Exe… |
CVE-2026-5473 | Medium | 4.5 | 2026-04-03 | A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation lead… |
CVE-2026-35537 | Low | 3.7 | 2026-04-03 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file… |
CVE-2026-34838 | Critical | 9.9 | 2026-04-02 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the Abst… |
CVE-2026-34877 | Critical | 9.8 | 2026-04-02 | An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures a… |
CVE-2026-29782 | High | 7.2 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is… |
CVE-2026-24165 | High | 7.8 | 2026-03-31 | NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to… |
CVE-2026-24164 | High | 8.8 | 2026-03-31 | NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to… |
CVE-2026-34202 | High | 7.5 | 2026-03-31 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing… |
CVE-2026-4266 | Medium | 6.7 | 2026-03-30 | An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesystem through another v… |
CVE-2026-4416 | High | 7.8 | 2026-03-30 | The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious… |
CVE-2026-4851 | Critical | 9.8 | 2026-03-29 | GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine provides Remote Procedure Calls (RPC)… |
CVE-2026-33728 | Critical | 9.8 | 2026-03-27 | dd-trace-java is a Datadog APM client for Java. In versions of dd-trace-java 0.40.0 through prior to 1.60.2, the RMI instrumentation registered a custom endpoi… |
CVE-2026-33725 | High | 7.2 | 2026-03-27 | Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58… |
CVE-2026-33701 | Critical | 9.8 | 2026-03-27 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI ins… |
CVE-2026-4860 | High | 7.3 | 2026-03-26 | A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/jav… |
CVE-2026-3328 | High | 7.2 | 2026-03-26 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in al… |
CVE-2026-33942 | Critical | 9.8 | 2026-03-26 | Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator… |
CVE-2026-32513 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archi… |
CVE-2026-32512 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pe… |
CVE-2026-32511 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7. |
CVE-2026-32510 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3. |
CVE-2026-32509 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4. |
CVE-2026-32508 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8. |
CVE-2026-32507 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4. |
CVE-2026-32506 | Medium | 5.4 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7. |
CVE-2026-32502 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm… |
CVE-2026-32484 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26. |
CVE-2026-27095 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Obje… |
CVE-2026-27084 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11. |
CVE-2026-27083 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel… |
CVE-2026-27082 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3… |
CVE-2026-27045 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affec… |
CVE-2026-25429 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1… |
CVE-2026-25400 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0. |
CVE-2026-25360 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9. |
CVE-2026-25359 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5. |
CVE-2026-25358 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2. |
CVE-2026-25032 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31. |
CVE-2026-25031 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a throug… |
CVE-2026-25030 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47. |
CVE-2026-25029 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24. |
CVE-2026-24989 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: fr… |
CVE-2026-24981 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n… |
CVE-2026-24978 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <=… |
CVE-2026-24976 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library… |
CVE-2026-24974 | High | 8.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <… |
CVE-2026-24378 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPr… |
CVE-2026-23971 | High | 8.1 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8. |
CVE-2026-22510 | High | 8.1 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6… |
CVE-2026-22507 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6. |
CVE-2026-22505 | High | 8.1 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: fro… |
CVE-2026-22500 | Critical | 9.8 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construc… |
CVE-2026-22480 | High | 7.2 | 2026-03-25 | Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Pro… |
CVE-2026-24159 | High | 7.8 | 2026-03-24 | NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code… |
CVE-2026-24157 | High | 7.8 | 2026-03-24 | NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerab… |
CVE-2026-24152 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A… |
CVE-2026-24151 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A succe… |
CVE-2026-24150 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A… |
CVE-2026-24141 | High | 7.8 | 2026-03-24 | NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by prov… |
CVE-2025-33248 | High | 7.8 | 2026-03-24 | NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously craft… |
CVE-2025-33247 | High | 7.8 | 2026-03-24 | NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulner… |
CVE-2025-33244 | Critical | 9.0 | 2026-03-24 | NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects envir… |
CVE-2026-4735 | | 2026-03-24 | Deserialization of Untrusted Data vulnerability in DTStack chunjun (chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associ… | |
CVE-2026-4538 | Medium | 5.3 | 2026-03-22 | A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to d… |
CVE-2026-0677 | Medium | 6.3 | 2026-03-20 | Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite… |
CVE-2026-29109 | High | 7.2 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe… |
CVE-2025-71260 | High | 8.8 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handlin… |
CVE-2026-25445 | High | 8.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a… |
CVE-2025-60237 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0. |
CVE-2025-60233 | Critical | 9.8 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2. |
CVE-2026-27096 | High | 8.1 | 2026-03-19 | Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects Colo… |
CVE-2026-25873 | Critical | 9.8 | 2026-03-18 | OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary co… |
CVE-2026-25449 | Critical | 9.8 | 2026-03-18 | Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. |
CVE-2026-25769 | Critical | 9.1 | 2026-03-17 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE)… |
CVE-2026-1323 | High | 8.8 | 2026-03-17 | The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted se… |
CVE-2025-54920 | High | 8.8 | 2026-03-16 | This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue. Summ… |
CVE-2026-32355 | High | 8.8 | 2026-03-13 | Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8… |
CVE-2025-13913 | Medium | 6.3 | 2026-03-12 | A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code. |
CVE-2026-3989 | High | 7.8 | 2026-03-12 | SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by pr… |
CVE-2026-3060 | Critical | 9.8 | 2026-03-12 | SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes unt… |
CVE-2026-3059 | Critical | 9.8 | 2026-03-12 | SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pi… |