CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- dassault systèmes station launcher app in 3dexperience platformDeserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x10.0 Critical
- jfrog artifactoryPotential remote code execution on an Artifactory package service container.8.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was...9.8 Critical
- techjewel fluent forms pro add on packFluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field8.8 High
- openidentityplatform openamOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass9.2 Critical
- lxsmnsyc serovalSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization9.8 Critical
- microsoft 365 copilotMicrosoft M365 Copilot Remote Code Execution Vulnerability9.9 Critical
- johnson control victor, johnson controls ccure 9000, victor application server +2 moreC-CURE 9000 and Victor application server - Deserialization of Untrusted Data8.7 High
- complianzWordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability7.2 High
- dokan proWordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability7.5 High
- thrive themes quiz builderWordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability9.8 Critical
- alibaba fastjsonRemote Code Execution in fastjson 1.2.68–1.2.839.0 Critical
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.8 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.8 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...8.8 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...9.8 Critical
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...9.9 Critical
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...9.8 Critical
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...10.0 Critical
- progress telerik ui for asp.net ajaxPersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- progress telerik ui for asp.net ajaxPersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX8.1 High
- oracle corporation java se, oracle jdk, jre +2 moreVulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are...7.4 High
- nvidia tranformers4recNVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper...4.3 Medium
- apache foryApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface9.8 Critical
- apache foryApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths9.8 Critical
- kvcache-ai ktransformersktransformers Unauthenticated Pickle Deserialization RCE via ZMQ9.3 Critical
- wazuhWazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node8.4 High
- keras-team keras-team/kerasUnsafe Deserialization in keras.layers.TorchModuleWrapper.from_config7.8 High
- ibm langflow oss, langflow +1 moreDisk Cache Deserialization Remote Code Execution Vulnerability9.9 Critical
- lmsys sglangCVE-2026-148909.1 Critical
- uncannyowl uncanny automator – easy automation, integration, webhooks & workflow builder pluginUncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token8.1 High
- nvidia tensorrtNVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of...5.3 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an...6.4 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an...7.8 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model...8.4 High
- microsoft dynamics nav, dynamics nav 2018 +1 moreMicrosoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability9.8 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +17 more +19 moreWireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability7.8 High
- microsoft azure active directory, .net framework, .net framework 3.5 +6 more +8 moreAzure Active Directory Denial of Service Vulnerability7.5 High
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability9.8 Critical
- microsoft sharepoint, sharepoint enterprise server 2016, sharepoint server 2019 +2 more +4 moreMicrosoft SharePoint Remote Code Execution Vulnerability9.8 Critical
- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 moreMicrosoft SQL Server Remote Code Execution Vulnerability9.8 Critical
- microsoft sql server 2025 (cu 6), sql server 2025 for x64-based systems (gdr), sql server 2016 +4 more +6 moreMicrosoft SQL Server Remote Code Execution Vulnerability9.8 Critical
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.8 High
- tribulant software newslettersNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field8.1 High
- sap se change and transport system attach tool (ctsattach)Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)7.6 High
- shapedplugin llc real testimonialsWordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability7.2 High
- wpwax directoristWordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability9.8 Critical
- themegoods grand photographyWordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability9.8 Critical
- stmcan rt-theme 18 | extensionsWordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes 777WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability9.8 Critical
- Show moreLoading…