CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- tomdever wpforo forumwpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields7.5 High
- victor rodriguez reycob product import exportWordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability7.2 High
- mlflowCVE-2026-968048.8 High
- mlflowMLflow dspy bypasses pickle deserialization control8.8 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities8.8 High
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel9.3 Critical
- recommenders-team recommendersrecommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization5.1 Medium
daskDebianDask Loader core.py from_npy_stack deserialization5.1 Medium- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.8 Critical
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities8.8 High
- apereo foundation openequellaopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker8.7 High
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability8.8 High
- softaculous virtualizorSoftaculous Virtualizor PHP Object Injection via Billing Module Handler9.2 Critical
- netdataNetdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE8.4 High
- getsentry sentrySentry: Unsafe pickle deserialization in Relocation Feature7.7 High
- mispMISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths7.7 High
- sgl-project sglangCVE-2026-930889.8 Critical
- nvidia nemo speechNVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an...8.8 High
- nvidia nemo speechNVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted...7.8 High
- nvidia nemo speechNVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an...7.8 High
- nvidia nemo speechNVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer...7.8 High
- unknown ninja formsNinja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export7.5 High
- liquidweb give tributesGive Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter9.8 Critical
- apache software foundation minaApache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-2329.8 Critical
- No product listedDeserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2...5.8 Medium
- dlr-rm stable-baselines3DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization5.3 Medium
- dmlc dgldmlc dgl utils.py _read_torch_data deserialization5.1 Medium
- piskvorky gensimpiskvorky gensim Model Loader utils.py load deserialization5.1 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection7.5 High
- cotontiCotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter7.7 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.5 Medium
- internlm lmdeployLMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py9.8 Critical
- ibm mqIBM MQ Java messaging is vulnerable to remote code execution7.5 High
- shortpixel image optimizer – optimize images, convert webp & avifShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content8.8 High
- hgiga oaklouds-custom page-2.0, oaklouds-custom page-3.0, oaklouds-custom page-4.0 +2 moreHGiga｜OAKlouds - Insecure Deserialization9.3 Critical
- netbox-community devicetype-libraryNetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request9.6 Critical
- b2evolution cmsb2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key9.2 Critical
- kedro-org kedro-pluginsKedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`7.7 High
- angel-ml angelAngel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes9.2 Critical
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability8.8 High
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability9.1 Critical
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability9.8 Critical
- cisco identity services engine softwareCisco Identity Services Engine Remote Code Execution Vulnerability9.1 Critical
- cisco identity services engine softwareCisco Identity Services Engine Remote Code Execution Vulnerability9.9 Critical
- internlm lmdeployLMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy9.8 Critical
- dell objectscaleDell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data...10.0 Critical
- cotontiCotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter9.3 Critical
- ibm mqIBM MQ Java messaging is vulnerable to remote code execution8.5 High
- ibm mqIBM MQ Java messaging is vulnerable to remote code execution8.8 High
- Show moreLoading…