cve.bz

CWE-502: Deserialization of Untrusted Data, page 13

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-71558EPSS 1.0%

    Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer dese…

  2. 9.8CVE-2026-16258EPSS 0.8%

    The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Aj…

  3. 9.9CVE-2026-50515EPSS 1.7%

    Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

  4. 9.8CVE-2026-65581EPSS 0.6%

    Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.

  5. 9.8CVE-2026-65579EPSS 0.6%

    Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

  6. 9.8CVE-2026-65578EPSS 0.6%

    Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

  7. 9.8CVE-2026-65577EPSS 0.6%

    Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

  8. 9.8CVE-2026-65576EPSS 0.6%

    Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

  9. 9.8CVE-2026-65575EPSS 0.6%

    Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

  10. 9.8CVE-2026-65574EPSS 0.6%

    Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

  11. 9.8CVE-2026-65573EPSS 0.6%

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

  12. 9.8CVE-2026-65572EPSS 0.6%

    Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

  13. 9.8CVE-2026-65571EPSS 0.6%

    Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.

  14. 9.8CVE-2026-65556EPSS 0.6%

    Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.

  15. 9.8CVE-2026-65552EPSS 0.6%

    Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.

  16. 7.2CVE-2026-65549EPSS 0.5%

    Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

  17. 9.8CVE-2026-28139EPSS 0.6%

    Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  18. 9.8CVE-2026-66909EPSS 1.1%

    Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a mal…

  19. 9.0CVE-2026-70426EPSS 0.5%

    In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting des…

  20. 7.6CVE-2026-71294EPSS 0.4%

    Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is pas…

  21. 8.8CVE-2026-71281EPSS 0.5%

    Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=…

  22. 9.8CVE-2026-61484EPSS 0.8%Unsupported when assigned

    Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alt…

  23. 9.3CVE-2026-70554EPSS 1.2%

    MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without valida…

  24. 8.2CVE-2026-47623EPSS 0.7%

    NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.

  25. 9.3CVE-2026-69098EPSS 0.9%

    kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ …

  26. 7.8CVE-2026-18642EPSS 0.4%

    Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.

  27. 4.1CVE-2026-16297EPSS 0.4%

    The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code…

  28. 8.1CVE-2025-15672EPSS 0.6%

    The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code exec…

  29. 7.7CVE-2026-3245EPSS 0.7%

    A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

  30. 6.6CVE-2026-16062EPSS 0.6%

    The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PH…

  31. 9.3CVE-2026-68771EPSS 1.1%

    ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserializ…

  32. 7.5CVE-2026-12720EPSS 0.5%

    The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later rev…

  33. 8.5CVE-2026-11536EPSS 0.6%

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

  34. 9.8CVE-2026-15976EPSS 0.6%

    SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization o…

  35. 9.8CVE-2026-15969EPSS 1.0%

    SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

  36. 9.8CVE-2026-12118EPSS 0.8%

    IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  37. 7.7CVE-2026-57859EPSS 0.5%

    e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the use…

  38. 7.5CVE-2026-1360EPSS 1.2%

    The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_cl…

  39. 10.0CVE-2026-65883EPSS 0.8%

    Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.

  40. 8.3CVE-2026-58163EPSS 0.7%

    Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Use…

  41. 9.8CVE-2026-14974EPSS 0.7%

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

  42. 9.8CVE-2026-14512EPSS 1.0%

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

  43. 9.8CVE-2026-66713EPSS 1.7%

    Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering is enabled, which is off by default) all…

  44. 10.0CVE-2026-11756EPSS 0.8%

    A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.

  45. 8.8CVE-2026-65617EPSS 0.6%

    A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

  46. 9.8CVE-2026-63077KEVExploitEPSS 94%

    In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

  47. 8.8CVE-2026-15962EPSS 0.5%

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscr…

  48. 9.9CVE-2026-50517EPSS 1.7%

    Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

  49. 8.7CVE-2026-21655EPSS 0.5%

    Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before …

  50. 7.2CVE-2026-65497EPSS 0.5%

    Administrator PHP Object Injection in Complianz <= 7.5.0 versions.