CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- themeum kirkiWordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability9.8 Critical
- marcus (aka @msykes) events managerWordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability8.8 High
- denishua wpjam basicWordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability8.8 High
- akariasai self-ragAkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization5.3 Medium
- yashbhalgat hashnerf-pytorchyashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization4.8 Medium
- yzhao062 pyodyzhao062 pyod persistence.py pyod.utils.persistence.load deserialization5.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.3 High
- linuxfoundation spinnakerSpinnaker: Improper yaml processing on kustomize bake operations7.5 High
- funstory-ai babeldocBabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py7.8 High
- dell unisphere for powermaxDell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of...8.8 High
- yeswikiYesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize9.4 Critical
- metabaseMetabase: Unsafe Deserialization of H2 Query Results9.9 Critical
- apache airflowApache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()9.8 Critical
- apache opennlp, apache software foundation opennlp :: core :: ml :: libsvm +1 moreApache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel7.3 High
- apache camelApache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder7.3 High
- apache camelApache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter9.8 Critical
- apache camelApache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remed…8.8 High
- apache camelApache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution8.1 High
- apache camelApache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure8.1 High
- apache camelApache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled8.1 High
- ad-security ad minerAD-Security AD_Miner Cache analyse_cache.py request_a deserialization4.8 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization8.8 High
- trailofbits ficklingFickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)8.8 High
- keras, keras-team keras-team/keras +1 moreDeserialization of Untrusted Data in keras-team/keras8.8 High
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization6.9 Medium
- themify popup, themifyme themify popup +1 moreWordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability8.8 High
- novalnet payment gateway for woocommerceWordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability9.8 Critical
- arraytics bookticsWordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability9.8 Critical
- fuelthemes werkstattWordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability8.8 High
- repute infosystems armember premiumWordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability8.8 High
- swaldman mchange-commons-javamchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"7.1 High
- amazon advanced jdbc wrapperRCE via Deserialization in AWS Advanced JDBC Wrapper7.7 High
- anyscale rayRay < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader8.6 High
- mediawikiRemote Code Execution via Unsafe Deserialization in LogItem Import5.9 Medium
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- hyland pacsgear, pacsgear mediawriter +1 morePACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service9.3 Critical
- hyland pacsgear, pacsgear pacs scan +1 morePACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service9.3 Critical
- bmc control-m/enterprise manager, control-m/server +1 moreImproper deserialization handling in Control-M Components8.9 High
- No product listedAn issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in...9.8 Critical
- swaldman c3p0c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties6.3 Medium
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale is affected by Insecure Deserilization7.5 High
- ibm langflow oss, langflow +1 moreInsecure Deserialization in Redis Cache Backend9.8 Critical
- deltaww dtmsoftDTMSoft - Deserialization of Untrusted Data Vulnerability8.4 High
- qlstudio export user dataExport User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field8.0 High
- Show moreLoading…