CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata9.8 Critical
- ibm langflow desktop, langflow +1 moreIBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file8.8 High
- project-monai monaiMONAI before 1.5.2 Remote Code Execution via Pickle Deserialization8.8 High
- rack rack-sessionRack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization9.3 Critical
- nvidia dali, data loading library +1 moreNVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted...7.3 High
- openidentityplatform openamPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM9.3 Critical
- huggingface huggingface/transformers, transformers +1 moreArbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers6.5 Medium
- pytries datriepytries datrie trie File datrie.pyx Trie.__setstate__ deserialization5.3 Medium
- fedml-ai fedmlFedML-AI FedML gRPC server grpc_server.py sendMessage deserialization6.9 Medium
- pyloadpyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution7.5 High
- nasa cfs, core flight system +1 moreNASA cFS Pickle pickle.load deserialization2.0 Low
- kedro-org kedroArbitrary Code Execution via Malicious Logging Configuration in Kedro9.8 Critical
- bulwarkmail webmailRoundcube Webmail: Unsafe deserialization in the redis/memcache session handler3.7 Low
- intermesh group-office, groupoffice +1 moreGroup-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`10.0 Critical
- arm mbed tlsAn issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0....9.8 Critical
- devcode openstamanagerOpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth27.2 High
- replicatorReplicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization6.5 Medium
- nvidia bionemo frameworkNVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted...7.8 High
- nvidia bionemo frameworkNVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted...8.8 High
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Insecure Deserialization in Fireware Access Portal8.4 High
- gigabyte performance libraryGIGABYTE｜Performance Library - Insecure Deserialization8.5 High
- casiano grid::machine, grid\ +1 moreGRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization9.8 Critical
- zcashfoundation zebra, zebra-chain +1 moreZebra node crash — V5 transaction hash panic (P2P reachable)9.2 Critical
- metabaseMetabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import7.2 High
com.splunk:splunk-otel-javaagentMavensplunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution9.3 Critical- datadog dd-trace-javadd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution9.3 Critical
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization6.9 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts7.2 High
- saloonSaloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)8.1 High
- linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation, red hat jboss enterprise application platform 8 +1 more +3 moreOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution9.3 Critical
- miguel useche js archive listWordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability8.8 High
- edge-themes peliculaWordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability9.8 Critical
- mikado-themes stålWordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes kamperenWordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes graceyWordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability5.4 Medium
- mikado-themes halsteinWordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability5.4 Medium
- elated-themes lerouxWordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability5.4 Medium
- edge-themes archiconWordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability5.4 Medium
- select-themes borgholmWordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability9.8 Critical
- boldgrid weformsWordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability8.8 High
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability9.8 Critical
- themerex buissonWordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex work & travel companyWordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability9.8 Critical
- themerex love storyWordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability9.8 Critical
- sbthemes woocommerce infinite scrollWordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability8.8 High
- wpdive nexa blocksWordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability9.8 Critical
- thememount apiconaWordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability8.8 High
- rascals vexWordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability8.8 High
- rascals pendulumWordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability8.8 High
- rascals melooWordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability8.8 High
- Show moreLoading…