CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +6 more +8 moreJboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller8.8 High
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server9.9 Critical
- ash-project ash, ash-hq ash framework +1 moreMemory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset5.9 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field8.1 High
- zenmlZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer8.5 High
- apache foryApache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata7.5 High
- apache foryApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization9.8 Critical
- apache foryApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path9.1 Critical
- unknown ajax search liteAjax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint9.8 Critical
- microsoft azure service busAzure Service Bus Remote Code Execution Vulnerability9.9 Critical
- axiomthemes ai annWordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes agricolaWordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability9.8 Critical
- agora foundation agoraWordPress Agora theme <= 1.9 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes adviceWordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes adrenaWordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes accaliaWordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes abogadoWordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability9.8 Critical
- themerex abelleWordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes a.williamsWordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability9.8 Critical
- axiomthemes 69 clothingWordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability9.8 Critical
- mihche wpbruiser {no- captcha anti-spam}WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability9.8 Critical
- qlstudio export user dataWordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability9.8 Critical
- jegtheme jeg kit for elementorWordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability7.2 High
- wpdreams ajax search liteWordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability9.8 Critical
- apache cxfApache CXF: Unsafe deserialization of inbound JMS ObjectMessage9.8 Critical
- jenkins project jenkins, remoting +1 moreIn Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...9.0 Critical
- cotontiCotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions7.7 High
- huggingface peftpeft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules8.8 High
- apache lucyApache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS9.8 Critical
- maxsite cmsMaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie9.3 Critical
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of...8.2 High
- cinnamon kotaemonkotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization9.3 Critical
- tubitak bilgem software technologies research institute eta-otp-lockRemote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock7.8 High
- creative motion clearfy cacheClearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import4.1 Medium
- unknown chamawpChama < 1.0.13 - Unauthenticated PHP Object Injection8.1 High
- canon production printing prismaproductionA deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to...7.7 High
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content6.6 Medium
- comfy-org comfyuiComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization9.3 Critical
- themeum kirkiKirki < 6.0.13 - Unauthenticated PHP Object Injection7.5 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a remote code execution vulnerability8.5 High
- lmsys sglangCVE-2026-159699.8 Critical
- lmsys sglangCVE-2026-159769.8 Critical
- ibm webmethods integration (on prem), webmethods integration +1 moreIBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data9.8 Critical
- e107inc e107e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()7.7 High
- buddypressBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data7.5 High
- aimy-extensions aimy captcha-less form guard, aimy-extensions.com aimy captcha-less form guard plugin for joomla +1 moreJoomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.010.0 Critical
- apache traffic serverApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server8.3 High
- ibm websphere application serverIBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities8.1 High
- apache software foundation axis2/java, apache axis2\/java +1 moreApache Axis2/Java: deserialization of untrusted Data9.8 Critical
- Show moreLoading…