CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- park of ideas rickyWordPress Ricky theme < 2.31 - PHP Object Injection vulnerability9.8 Critical
- park of ideas tasty dailyWordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability9.8 Critical
- park of ideas goldishWordPress Goldish theme < 3.47 - PHP Object Injection vulnerability9.8 Critical
- park of ideas kidzWordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability9.8 Critical
- fantasticplugins sumo affiliates proWordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability9.8 Critical
- nootheme visionary coreWordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability8.8 High
- nootheme jobica coreWordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability8.8 High
- nootheme organici libraryWordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability8.8 High
- nootheme citilightsWordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability8.8 High
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability9.8 Critical
- xtemos woodmartWordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability8.1 High
- ancorathemes melodyWordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability8.1 High
- ancorathemes beeloveWordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes morning recordsWordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability8.1 High
- axiomthemes m2 | construction and tools storeWordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability9.8 Critical
- webtoffee product feed for woocommerceWordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability7.2 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading7.8 High
- nvidia model optimizerNVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization...7.8 High
- nvidia apexNVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a...9.0 Critical
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an...7.8 High
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by...7.8 High
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an...7.8 High
- nvidia megatron-lm, megatron lm +1 moreNVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may...7.8 High
- nvidia megatron lm, megatron-lm +1 moreNVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could...7.8 High
- dtstack chunjunA stack overflow and DoS vulnerability in DTStack/chunjun8.7 High
- linuxfoundation pytorchPyTorch pt2 Loading deserialization4.8 Medium
- totalsuite totalcontest liteWordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability6.3 Medium
- suitecrm, suitecrm suitecrm-core +1 moreSuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing8.6 High
- bmc footprintsBMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE8.7 High
- membership software wishlist member xWordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability8.8 High
- themeton finagWordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- themeton zuutWordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability9.8 Critical
- buddhathemes colorfolio - freelance designer wordpress themeWordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability8.1 High
- beijing academy of artificial intelligence (baai) omnigen2-rlOmniGen2-RL Reward Server Unsafe Deserialization RCE9.3 Critical
- hclsoftware travelerWordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability9.8 Critical
- wazuhWazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization9.1 Critical
- cps-it mailqueue, typo3 extension "mailqueue" +1 moreInsecure Deserialization in extension "Mailqueue" (mailqueue)5.2 Medium
- apache sparkApache Spark: Spark History Server Code Execution Vulnerability8.8 High
- crocoblock jetengineWordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability8.8 High
- inductive automation ignition software, inductiveautomation ignition +1 moreInductive Automation Ignition Software Deserialization of Untrusted Data5.4 Medium
- lmsys sglangCVE-2026-39897.8 High
- lmsys sglangCVE-2026-30609.8 Critical
- lmsys sglangCVE-2026-30599.8 Critical
- alfresco activitiAlfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization5.3 Medium
- glpi-project glpiGLPI affected by Remote Code Execution via malicious upload8.1 High
- unknown divi-boosterDivi Booster < 5.0.2 - Unauthenticated PHP Object Injection8.1 High
- schneider electric ecostruxure™ foxboro dcs, schneider-electric ecostruxure foxboro dcs control software +1 moreCWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of...7.0 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +2 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft windows adk for windows 10, version 2004, windows adk for windows 11, version 22h2, windows adk for windows 11, version 23h2 +14 more +16 moreWindows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability7.8 High
- Show moreLoading…