CWE-502 · Deserialization of Untrusted Data (page 9)
Page 9 of 31 — CVEs classified under CWE-502, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67729 | High | 8.8 | 2025-12-26 | LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where… |
CVE-2025-68038 | High | 7.2 | 2025-12-24 | Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Exp… |
CVE-2025-68665 | High | 8.6 | 2025-12-23 | LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and… |
CVE-2025-68664 | Critical | 9.3 | 2025-12-23 | LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists i… |
CVE-2025-13716 | High | 7.8 | 2025-12-23 | Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-13715 | High | 7.8 | 2025-12-23 | Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-13714 | High | 7.8 | 2025-12-23 | Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2025-13713 | High | 7.8 | 2025-12-23 | Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-13712 | High | 7.8 | 2025-12-23 | Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-13711 | High | 7.8 | 2025-12-23 | Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-13710 | High | 7.8 | 2025-12-23 | Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2025-13709 | High | 7.8 | 2025-12-23 | Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2025-13708 | High | 7.8 | 2025-12-23 | Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote att… |
CVE-2025-13707 | High | 7.8 | 2025-12-23 | Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2025-13706 | High | 7.8 | 2025-12-23 | Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2025-14931 | Critical | 10.0 | 2025-12-23 | Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2025-14930 | High | 7.8 | 2025-12-23 | Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-14929 | High | 7.8 | 2025-12-23 | Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote… |
CVE-2025-14925 | High | 7.8 | 2025-12-23 | Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-14924 | High | 7.8 | 2025-12-23 | Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex… |
CVE-2025-14922 | High | 7.8 | 2025-12-23 | Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2025-14921 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacker… |
CVE-2025-14920 | High | 7.8 | 2025-12-23 | Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2025-14071 | High | 7.5 | 2025-12-21 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via d… |
CVE-2025-65035 | Medium | 6.4 | 2025-12-19 | pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Pr… |
CVE-2025-66524 | High | 8.8 | 2025-12-19 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for s… |
CVE-2025-34449 | Critical | 9.1 | 2025-12-18 | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() funct… |
CVE-2025-63951 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c4… |
CVE-2025-63950 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621… |
CVE-2025-64266 | High | 8.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection… |
CVE-2025-64233 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8. |
CVE-2025-64227 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Clie… |
CVE-2025-64206 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0. |
CVE-2025-60180 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP G… |
CVE-2025-60178 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms Hu… |
CVE-2025-60174 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue af… |
CVE-2025-60091 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity… |
CVE-2025-60090 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Form… |
CVE-2025-60089 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravi… |
CVE-2025-60084 | High | 8.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object I… |
CVE-2025-60083 | High | 8.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affec… |
CVE-2025-60082 | High | 8.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from… |
CVE-2025-60081 | High | 8.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for… |
CVE-2025-60080 | High | 7.5 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injec… |
CVE-2025-54723 | Critical | 9.8 | 2025-12-18 | Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4… |
CVE-2025-33226 | High | 7.8 | 2025-12-16 | NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A successful exploit o… |
CVE-2025-33212 | High | 7.3 | 2025-12-16 | NVIDIA NeMo Framework contains a vulnerability in model loading that could allow an attacker to exploit improper control mechanisms if a user loads a malicious… |
CVE-2025-33210 | Critical | 9.0 | 2025-12-16 | NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to code execution. |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67747 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module im… |
CVE-2025-9121 | High | 8.8 | 2025-12-15 | Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data… |
CVE-2025-65213 | Critical | 9.8 | 2025-12-15 | MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and… |
CVE-2025-14606 | Medium | 5.0 | 2025-12-13 | A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of the file pickle_con… |
CVE-2025-14476 | High | 8.8 | 2025-12-13 | The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via… |
CVE-2025-26866 | High | 8.8 | 2025-12-12 | A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-… |
CVE-2025-14044 | High | 8.1 | 2025-12-12 | The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted… |
CVE-2025-67779 | High | 7.5 | 2025-12-12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific cas… |
CVE-2025-55184 | High | 7.5 | 2025-12-11 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, inclu… |
CVE-2025-34394 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected a… |
CVE-2025-9571 | | 2025-12-10 | A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execu… | |
CVE-2025-61810 | High | 8.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-66214 | High | 7.0 | 2025-12-09 | Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/la… |
CVE-2025-34414 | | 2025-12-09 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2025-33214 | High | 8.8 | 2025-12-09 | NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this v… |
CVE-2025-33213 | High | 8.8 | 2025-12-09 | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful expl… |
CVE-2025-67535 | Medium | 6.6 | 2025-12-09 | Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue… |
CVE-2025-66631 | Critical | 9.8 | 2025-12-09 | CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of… |
CVE-2025-42928 | Critical | 9.1 | 2025-12-09 | Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may… |
CVE-2025-63721 | High | 8.8 | 2025-12-08 | HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve R… |
CVE-2025-66571 | | 2025-12-04 | UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed… | |
CVE-2025-55182 | Critical | 10.0 | 2025-12-03 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following… |
CVE-2025-41700 | High | 7.8 | 2025-12-01 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS deve… |
CVE-2025-13805 | Low | 3.7 | 2025-12-01 | A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/ma… |
CVE-2025-9191 | Medium | 6.3 | 2025-11-26 | The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in save… |
CVE-2025-62703 | High | 8.8 | 2025-11-25 | Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In v… |
CVE-2025-51746 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51745 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51744 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51743 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks. |
CVE-2025-51742 | Critical | 9.8 | 2025-11-25 | An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to par… |
CVE-2025-61168 | Critical | 9.8 | 2025-11-25 | An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. |
CVE-2025-13467 | Medium | 5.5 | 2025-11-25 | A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of un… |
CVE-2025-66073 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through… |
CVE-2025-66055 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email S… |
CVE-2025-62164 | High | 8.8 | 2025-11-21 | vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead t… |
CVE-2025-59245 | Critical | 9.8 | 2025-11-20 | Microsoft SharePoint Online Elevation of Privilege Vulnerability |
CVE-2025-36072 | High | 8.8 | 2025-11-20 | IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an… |
CVE-2025-64408 | Medium | 6.3 | 2025-11-19 | Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabiliti… |
CVE-2025-13145 | High | 7.2 | 2025-11-19 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1… |
CVE-2025-60455 | High | 8.4 | 2025-11-18 | Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing att… |
CVE-2025-13081 | Medium | 5.9 | 2025-11-18 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D… |
CVE-2025-12844 | High | 7.1 | 2025-11-13 | The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserializati… |
CVE-2025-11367 | Critical | 9.8 | 2025-11-12 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization |
CVE-2025-62204 | High | 8.0 | 2025-11-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-64512 | High | 8.6 | 2025-11-10 | Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer… |
CVE-2025-63617 | Medium | 6.5 | 2025-11-10 | ktg-mes before commit a484f96 (2025-07-03) has a fastjson deserialization vulnerability. This is because it uses a vulnerable version of fastjson and deseriali… |
CVE-2025-12099 | High | 7.2 | 2025-11-08 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and in… |
CVE-2025-64439 | | 2025-11-07 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and b… | |
CVE-2025-62035 | High | 8.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4. |
CVE-2025-60245 | Critical | 9.8 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager… |