cve.bz

CWE-502: Deserialization of Untrusted Data, page 14

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2026-65497EPSS 0.5%

    Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

  2. 7.5CVE-2026-65493EPSS 0.4%

    Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

  3. 9.8CVE-2026-59544EPSS 0.6%

    Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

  4. 9.0CVE-2026-16723EPSS 0.7%

    A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

  5. 8.8CVE-2026-61246EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  6. 8.8CVE-2026-60439EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  7. 8.8CVE-2026-60373EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  8. 9.8CVE-2026-60372EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  9. 9.9CVE-2026-60369EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  10. 9.8CVE-2026-60367EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  11. 10.0CVE-2026-60366EPSS 0.5%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability all…

  12. 8.1CVE-2026-13190EPSS 0.5%

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

  13. 8.1CVE-2026-13185EPSS 0.7%

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

  14. 7.4CVE-2026-47058EPSS 0.4%

    Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via mu…

  15. 4.3CVE-2026-24232EPSS 0.4%

    NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

  16. 9.8CVE-2026-64606EPSS 0.8%

    Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users a…

  17. 9.8CVE-2026-64608EPSS 0.8%

    Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input w…

  18. 9.3CVE-2026-63767EPSS 1.1%

    ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ…

  19. 9.1CVE-2026-28220EPSS 0.7%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the clu…

  20. 7.8CVE-2026-12484EPSS 0.3%

    A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weigh…

  21. 9.9CVE-2026-8476EPSS 1.0%

    IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk…

  22. 8.0CVE-2026-45162EPSS 1.0%

    Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restrict…

  23. 9.1CVE-2026-14890EPSS 1.0%

    SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file t…

  24. 8.1CVE-2026-15008EPSS 1.0%

    The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to,…

  25. 7.8CVE-2026-47472EPSS 0.3%

    NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, infor…

  26. 8.4CVE-2026-24233EPSS 0.4%

    NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this v…

  27. 9.8CVE-2026-24227EPSS 1.0%

    NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.

  28. 6.4CVE-2026-24220EPSS 0.3%

    NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to co…

  29. 7.8CVE-2026-50649EPSS 4.0%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

  30. 7.8CVE-2026-50646EPSS 4.0%

    Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

  31. 9.8CVE-2026-55944EPSS 1.5%

    Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

  32. 7.8CVE-2026-50509EPSS 3.5%

    Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

  33. 8.3CVE-2026-45077EPSS 0.7%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 …

  34. 9.8CVE-2026-58644KEVExploitEPSS 16%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  35. 7.8CVE-2026-55009EPSS 2.5%

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

  36. 9.8CVE-2026-54118EPSS 1.5%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  37. 9.8CVE-2026-54117EPSS 1.5%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  38. 7.5CVE-2026-50652EPSS 1.7%

    Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

  39. 9.8CVE-2026-50522KEVEPSS 3.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  40. 8.1CVE-2026-12583EPSS 0.6%

    The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bund…

  41. 7.6CVE-2026-58233EPSS 0.6%

    SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote…

  42. 7.2CVE-2026-59521EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.

  43. 9.8CVE-2026-59518EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.

  44. 9.8CVE-2026-57770EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

  45. 9.8CVE-2026-57744EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  46. 9.8CVE-2026-57738EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

  47. 9.8CVE-2026-57724EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

  48. 8.8CVE-2026-57713EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

  49. 8.8CVE-2026-57371EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.

  50. 2.1CVE-2026-15535EPSS 0.4%

    A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Execu…