CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- nvidia nvtabularNVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization...7.8 High
- elated-themes askkaWordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability8.1 High
- elated-themes töbelWordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability8.1 High
- elated-themes aperitifWordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability8.1 High
- foundationagents metagptFoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization4.8 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by remote code execution8.5 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a remote code execution vulnerability9.0 Critical
- amd aiter, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 moreAI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization9.2 Critical
- qos.ch sarl logbackLogback deserialization whitelist bypass for Proxy objects2.9 Low
- apache airflowApache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator8.8 High
- apache airflowApache Airflow: Arbitrary import in custom deadline-reference deserialization7.3 High
- dassault systèmes magic collaboration studio, teamwork cloud - business edition, teamwork cloud - business pro edition +2 more +4 moreDeserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x throug…9.8 Critical
- No product listedAn issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted...7.8 High
- zyddnys manga-image-translatormanga-image-translator RCE via Unsafe Pickle Deserialization in Share Model9.2 Critical
- sbthemes woocommerce infinite scroll and ajax paginationWooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- qos.ch sarl logbackLogback deserialization whitelist bypass for java.lang and java.util2.9 Low
- No product listedAn issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the...7.3 High
- sensiolabs symfony, symfony monolog-bridge +1 moreSymfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener8.3 High
- inducer relateRELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization8.7 High
- pimcorePimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction8.0 High
- jenkins active directory, jenkins project active directory plugin +1 moreJenkins Active Directory Plugin deserializes data from LDAP referrals without validation6.6 Medium
- jenkins ldap, jenkins project ldap plugin +1 moreJenkins LDAP Plugin deserializes data from LDAP referrals without validation6.6 Medium
- nvidia transformers4rec, merlin transformers4rec +1 moreNVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- mirasvit full page cache warmer for magento 2, full page cache warmer +1 moreMirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection9.3 Critical
- changmingxie tcc-transactionchangmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization5.3 Medium
- huggingface huggingface/transformers, transformers +1 moreArbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers7.8 High
- microsoft planetary computer, planetary computer pro (geocatalog) +1 moreMicrosoft Planetary Computer Pro Information Disclosure Vulnerability10.0 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Remote Code Execution Vulnerability8.8 High
- aws amazon braket python sdkInsecure Deserialization in Amazon Braket SDK Job Results Processing7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 moreInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.8.9 High
- apache foryApache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement9.8 Critical
- nvidia bionemo frameworkNVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of...7.8 High
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could ...7.5 High
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized...6.3 Medium
- nvidia tensorrt-llm, tensorrt llm +1 moreNVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could...7.5 High
- microsoft boostBoost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie9.8 Critical
- jaspersoft jasperreports io at-scale, jasperreports io professional, jasperreports library community edition +5 more +7 moreJaspersoft Library Deserialisation Vulnerability8.7 High
- hestiacpHestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal9.5 Critical
- typo3 extension "content element selector"Remote Code Execution in extension "Content Element Selector" (ceselector)9.2 Critical
- typo3 extension "site crawler"Remote Code Execution in extension "Site Crawler" (crawler)7.1 High
- significant-gravitas autogptAutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries7.6 High
- red hat ansible automation platform 2, openstack platform 18.0, quay 3 +1 more +3 moreAPScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization9.8 Critical
- red hat openshift ai (rhoai)ModelScope is vulnerable to arbitrary code injection via a crafted module7.3 High
- freepbx security-reportingFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php8.6 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3 +1 moreChromaDB Python project has a pre-authentication code injection vulnerability10.0 Critical
graphitedbPyPIGraphite Has a Pickle Deserialization Vulnerability7.8 High- lmsys sglangCVE-2026-73049.8 Critical
- lmsys sglangCVE-2026-73019.8 Critical
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 JAR Model.java importBinaryModel deserialization6.9 Medium
- Show moreLoading…