cve.bz

CWE-502: Deserialization of Untrusted Data, page 11

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.8CVE-2026-59306EPSS 0.2%

    Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

  2. 8.1CVE-2026-59285EPSS 0.4%

    Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

  3. 8.7CVE-2026-10036EPSS 0.7%

    SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enume…

  4. 9.8CVE-2026-78292EPSS 0.6%

    Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

  5. 9.8CVE-2026-78286EPSS 0.6%

    Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

  6. 7.2CVE-2026-78276EPSS 0.5%

    Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

  7. 8.8CVE-2026-78257EPSS 0.5%

    Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

  8. 4.9CVE-2026-59275EPSS 0.4%

    A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring …

  9. 7.3CVE-2026-47878EPSS 0.4%

    DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist…

  10. 9.8CVE-2026-47875EPSS 0.4%

    Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not pr…

  11. 9.8CVE-2026-47864EPSS 5.9%

    SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serial…

  12. 6.3CVE-2026-47856EPSS 0.3%

    Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7…

  13. 9.3CVE-2026-51106EPSS 0.4%

    An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component

  14. 9.3CVE-2026-80428ExploitEPSS 4.7%

    ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpo…

  15. 9.8CVE-2026-51368EPSS 0.9%

    An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint

  16. 9.3CVE-2026-79657EPSS 1.3%

    NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerou…

  17. 9.3CVE-2026-77138EPSS 0.7%

    The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, lead…

  18. 7.7CVE-2026-56095EPSS 0.3%

    The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object typ…

  19. 9.4CVE-2026-78683EPSS 0.5%

    NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=Fals…

  20. 9.8CVE-2026-78265EPSS 0.6%

    Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

  21. 9.8CVE-2026-78262EPSS 0.6%

    Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

  22. 9.8CVE-2026-32563EPSS 0.6%

    Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

  23. 8.7CVE-2026-40877EPSS 0.5%

    Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in the user preference functionality, which can lead to remote code execution. This issue has been fixed in version 3.2.3.

  24. 8.4CVE-2026-76843EPSS 0.4%

    The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model fi…

  25. 9.8CVE-2026-66650EPSS 0.6%

    Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

  26. 6.9CVE-2026-78147EPSS 0.6%

    A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op…

  27. 8.8CVE-2026-0551EPSS 0.7%

    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This ma…

  28. 9.8CVE-2026-4703EPSS 0.9%

    The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This make…

  29. 8.7CVE-2026-71513EPSS 1.1%

    NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables ou…

  30. 7.8CVE-2026-54071EPSS 0.4%

    BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values…

  31. 7.7CVE-2026-77646EPSS 0.4%

    A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

  32. 9.2CVE-2026-77645EPSS 0.6%

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

  33. 10.0CVE-2026-69836EPSS 1.8%

    Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

  34. 7.8CVE-2026-18285EPSS 0.5%

    Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Aeon. User interaction is required to exp…

  35. 7.8CVE-2026-15679EPSS 0.4%

    Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Imag…

  36. 9.8CVE-2026-73993EPSS 0.6%

    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

  37. 9.8CVE-2026-66672EPSS 0.6%

    Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

  38. 9.8CVE-2026-66583EPSS 0.6%

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

  39. 9.3CVE-2026-76850EPSS 1.3%

    LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received b…

  40. 9.1CVE-2026-76404EPSS 0.7%

    In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's cre…

  41. 8.8CVE-2026-76395EPSS 0.7%

    In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is p…

  42. 8.4CVE-2026-44901EPSS 0.7%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a c…

  43. 7.8CVE-2026-49817EPSS 0.3%

    Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

  44. 7.8CVE-2026-49816EPSS 0.3%

    Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

  45. 9.8CVE-2026-73389EPSS 0.6%

    Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

  46. 9.8CVE-2026-73364EPSS 0.6%

    Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.

  47. 6.9CVE-2026-75987EPSS 0.6%

    A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remo…

  48. 7.8CVE-2026-60412EPSS 0.3%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with lo…

  49. 7.8CVE-2026-60392EPSS 0.3%

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attack…

  50. 8.8CVE-2026-74012EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.