CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client ...8.1 High
- openmix mix phpUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP...8.4 High
- hyperledger fabricObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE9.3 Critical
- phpoffice phpspreadsheetPhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load9.2 Critical
- jenkins matrix authorization strategy, jenkins project matrix authorization strategy plugin +1 moreJenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors6.5 Medium
- grav cmsGrav CMS Cache Value FileCache.php doGet deserialization2.3 Low
- nvidia flare sdk, nvflare +1 moreNVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization...8.8 High
- stellar-group hpxInsecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions...9.8 Critical
- No product listedAn issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input...5.3 Medium
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store8.8 High
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)9.4 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository8.8 High
- apache minaApache MINA: CWE-502 Deserialization of Untrusted Data9.8 Critical
- apache minaApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE9.8 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp9.8 Critical
- apache camel, apache software foundation camel pqc, red hat build of apache camel for spring boot 4 +2 moreApache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager7.8 High
- apache camel, apache software foundation camel mina, red hat build of apache camel for spring boot 4 +1 more +3 moreApache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP8.8 High
github.com/k8sgpt-ai/k8sgptGok8sGPT has Prompt Injection through its k8sGPT-Operator8.7 High- anyscale rayRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization8.9 High
- apache dolphinschedulerApache DolphinScheduler: Deserialization of untrusted data in RPC6.3 Medium
- microsoft bingMicrosoft Bing Remote Code Execution Vulnerability10.0 Critical
- kvcache-ai ktransformersKTransformers Unsafe Deserialization RCE via balance_serve9.3 Critical
- hugging face lerobotLeRobot Unsafe Deserialization Remote Code Execution via gRPC9.3 Critical
- pipecatPipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer9.8 Critical
- ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 moreERB has an @_init deserialization guard bypass via def_module / def_method / def_class8.1 High
- red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33, build of apache camel 4.18.1 for spring boot 3.5.14 +3 more +5 moreCamel-infinispan: camel-infinispan: remote code execution via unsafe deserialization7.5 High
- progress telerik ui for asp.net ajaxDeserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...7.5 High
- metaslider responsive slider by metasliderWordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability7.2 High
- openmage magento, magento-lts +1 moreOpenMage LTS's Phar Deserialization leads to Remote Code Execution8.1 High
- apache airflowApache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)7.2 High
- firebirdsql firebirdFirebird has a buffer overflow when parsing corrupted slice packets7.5 High
- dataeaseDataEase: Quartz Deserialization → Remote Code Execution7.5 High
- digital knowledge knowledgedeliverKnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value9.1 Critical
- opentext, inc rightfaxDeserialization of untrusted data vulnerability in OpenText, Inc RightFax on Windows, 64 bit, 32...9.3 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.6 Critical
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.3 Critical
- microsoft azure monitor, azure monitor agent +1 moreAzure Monitor Agent Elevation of Privilege Vulnerability7.8 High
- microsoft hpc pack, hpc pack 2019 +1 moreMicrosoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability7.8 High
- shapedplugin smart post show – post grid, post carousel & slider, and list category postsSmart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection7.2 High
- pachnoPachno 1.0.6 FileCache Deserialization Remote Code Execution9.3 Critical
- keras, keras-team keras-team/keras, red hat openshift ai (rhoai) +3 more +5 moreSafe Mode Bypass in keras-team/keras8.8 High
- apache airflowApache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API8.8 High
- apache storm, apache software foundation storm client +1 moreApache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling8.8 High
- samsung escargotDeserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script...6.2 Medium
- wolfsslSession Cache Restore — Arbitrary Free via Deserialized Pointer4.1 Medium
- sonatype nexus repository, nexus repository manager +1 moreNexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection9.4 Critical
- mervinpraison praisonaiPraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading9.8 Critical
- meta react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +1 more +3 moreReact Server Components have a Denial of Service Vulnerability7.5 High
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +8 more +10 moreMirror-registry: remote code execution using pickle deserialization7.1 High
- Show moreLoading…