CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- oinone pamirsOinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization5.3 Medium
- jsonpickle python jsonpickle, red hat ansible automation platform 2 +1 morepython jsonpickle 2.0.0 Remote Code Execution via py/repr9.3 Critical
- oalders www::mechanize::cached, www\ +1 moreWWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution5.3 Medium
@tanstack/start-server-corenpmTanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function6.3 Medium- datahubDataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability4.3 Medium
- gitlabDeserialization of Untrusted Data in GitLab6.5 Medium
- langchain-ai langsmith-sdkLangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning7.1 High
- f5 big-ip, big-iq, big-ip access policy manager +21 more +23 moreBIG-IP and BIG-IQ Configuration utility vulnerability8.7 High
- gdragon coreactivity: activity logging for wordpresscoreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field8.1 High
- adobe connect, connect desktop application +1 moreAdobe Connect | Deserialization of Untrusted Data (CWE-502)9.6 Critical
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.0 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
mamba-ssmPyPImamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub9.8 CriticalludwigPyPILudwig framework is vulnerable to insecure deserialization in its model serving component9.8 CriticalludwigPyPILudwig framework is vulnerable to insecure deserialization through its predict() method.9.8 CriticalimgaugPyPIimgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module9.8 CriticalhorovodPyPIHorovod contains an insecure deserialization vulnerability in its KVStore HTTP server component9.8 Critical- No product listedThe CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains...8.8 High
- No product listedThe Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization...9.8 Critical
- snorkelSnorkel MultitaskClassifier.load uses an unsafe torch.load8.8 High
- snorkelSnorkel BaseLabeler.load uses an unsafe pickle.load8.8 High
- snorkelSnorkel Trainer.load uses an unsafe torch.load8.8 High
- lightningai pytorch lightningPyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization7.8 High
- No product listedThe _load_model() function in the neural_magic_training.py script of the optimate project in...8.8 High
- No product listedThe _load_model() function in the neural_magic_training.py script of the optimate project in...8.8 High
- No product listedThe torch-checkpoint-shrink.py script in the ml-engineering project in commit...9.8 Critical
torrentpier/torrentpierPackagisttorrentpier has PHP Serialize InjectionsNo score- sonatype nexus repository, nexus repository manager +1 moreNexus Repository 3 - Improper LDAP Referral Handling5.1 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution7.3 High
flash-attnPyPIflash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism7.3 High- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...7.3 High
- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...7.3 High
- langchainLangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists8.2 High
- seppmail ag secure email gatewayInsecure deserialization9.2 Critical
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- pfsenseNetgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file...9.1 Critical
- No product listedLINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad...7.3 High
- getgrav gravGrav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection9.3 Critical
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +5 more +7 moreApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader9.8 Critical
- No product listedMindsDB Pickle pickle.loads deserialization5.3 Medium
- cozmoslabs profile builder proProfile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection8.1 High
- mem0ai mem0mem0ai mem0 faiss.py pickle.dump deserialization5.3 Medium
- apache minaApache MINA: CWE-502 Deserialization of Untrusted Data (take 2)9.8 Critical
- apache minaApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)9.8 Critical
- zhinst labone qArbitrary Code Execution via Unsafe Deserialization in LabOne Q8.4 High
- No product listedUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache...9.8 Critical
- No product listedUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache...9.8 Critical
- Show moreLoading…