cve.bz

CWE-502: Deserialization of Untrusted Data, page 12

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-73397EPSS 0.6%

    Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

  2. 9.8CVE-2026-73380EPSS 0.6%

    Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

  3. 9.8CVE-2026-73376EPSS 0.6%

    Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

  4. 9.8CVE-2026-73366EPSS 0.6%

    Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

  5. 9.8CVE-2026-73341EPSS 0.6%

    Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

  6. 7.2CVE-2026-66620EPSS 0.5%

    Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

  7. 9.8CVE-2026-59940EPSS 0.8%

    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general d…

  8. 9.8CVE-2026-32470EPSS 0.6%

    Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

  9. 8.8CVE-2026-32465EPSS 0.5%

    Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

  10. 8.0CVE-2026-16138EPSS 0.8%

    In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller ho…

  11. 9.8CVE-2024-13784EPSS 0.8%

    The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes i…

  12. 6.6CVE-2026-10035EPSS 0.7%

    The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached thr…

  13. 8.8CVE-2026-16099EPSS 1.1%

    The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_link_item function in all versions up to, and including, 4.5.3. This makes it possible for a…

  14. 6.1CVE-2025-7639EPSS 0.6%

    The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Ente…

  15. 5.5CVE-2026-19826EPSS 0.6%

    A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deseria…

  16. 5.3CVE-2026-10571EPSS 0.6%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources …

  17. 7.2CVE-2026-66256EPSS 0.9%Unsupported when assigned

    Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the …

  18. 8.8CVE-2026-28176EPSS 0.5%

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

  19. 9.8CVE-2026-28149EPSS 0.6%

    Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

  20. 7.2CVE-2026-27380EPSS 0.5%

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

  21. 7.5CVE-2026-67579EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the da…

  22. 8.4CVE-2026-73325EPSS 0.4%

    Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized…

  23. 8.8CVE-2026-67587EPSS 0.6%

    Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because `SyncCallback` is itself an Airflow class it passes the default `…

  24. 7.3CVE-2026-67260EPSS 0.8%

    Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who contr…

  25. 5.4CVE-2026-59242EPSS 0.5%

    Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user w…

  26. 8.8CVE-2026-58076EPSS 0.5%

    Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imp…

  27. 6.6CVE-2026-68756EPSS 0.5%

    A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

  28. 8.4CVE-2026-18634EPSS 0.3%

    An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this…

  29. 8.6CVE-2026-48397EPSS 1.0%

    Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Ex…

  30. 8.8CVE-2026-70321EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  31. 8.8CVE-2026-66808EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  32. 8.8CVE-2026-66805EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  33. 8.8CVE-2026-65815EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

  34. 8.8CVE-2026-65665EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  35. 8.8CVE-2026-65663EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  36. 8.8CVE-2026-65658EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  37. 8.8CVE-2026-64901EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  38. 6.5CVE-2026-63516EPSS 1.9%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

  39. 8.8CVE-2026-63514EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  40. 6.5CVE-2026-62912EPSS 2.0%

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

  41. 9.8CVE-2026-59124EPSS 1.5%

    Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

  42. 4.6CVE-2026-35502EPSS 0.3%

    Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined wit…

  43. 10.0CVE-2026-17061EPSS 0.8%

    A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.

  44. 8.8CVE-2026-15555EPSS 0.8%

    A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on ev…

  45. 9.9CVE-2026-18948EPSS 1.1%

    A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthent…

  46. 5.9CVE-2026-69659EPSS 0.4%

    Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page[:afte…

  47. 8.1CVE-2026-16267EPSS 0.5%

    The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

  48. 8.5CVE-2026-68772EPSS 0.8%

    ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attacker…

  49. 9.1CVE-2026-71560EPSS 0.8%

    Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an …

  50. 7.5CVE-2026-71559EPSS 0.8%

    Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This i…