cve.bz

CWE-502: Deserialization of Untrusted Data, page 16

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-24247EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  2. 7.8CVE-2026-24245EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  3. 7.8CVE-2026-24244EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  4. 7.8CVE-2026-24243EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  5. 7.8CVE-2026-24240EPSS 0.4%

    NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, a…

  6. 8.9CVE-2026-10538EPSS 0.4%

    Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentiall…

  7. 9.3CVE-2026-56700EPSS 2.5%

    Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowe…

  8. 6.3CVE-2026-55223EPSS 0.5%

    c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection() and ConnectionPoolDataSour…

  9. 7.6CVE-2025-71374EPSS 0.7%

    picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass pickl…

  10. 7.6CVE-2025-71371EPSS 0.6%

    picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pi…

  11. 7.6CVE-2025-71368EPSS 0.8%

    picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls th…

  12. 7.6CVE-2025-71363EPSS 0.7%

    picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklesca…

  13. 7.6CVE-2025-71350EPSS 0.4%

    picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

  14. 7.6CVE-2025-71349EPSS 0.6%

    picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in t…

  15. 9.8CVE-2026-7871EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.

  16. 8.8CVE-2026-13759EPSS 0.5%

    IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on …

  17. 8.4CVE-2026-12578EPSS 0.4%

    The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.

  18. 8.0CVE-2026-12240EPSS 0.6%

    The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated a…

  19. 9.9CVE-2026-46386EPSS 0.5%

    OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :mar…

  20. 8.7CVE-2026-57527EPSS 0.7%

    Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java…

  21. 9.8CVE-2026-56057EPSS 0.6%

    Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

  22. 8.8CVE-2026-56055EPSS 0.5%

    Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

  23. 9.8CVE-2026-56032EPSS 0.6%

    Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

  24. 8.1CVE-2026-56031EPSS 0.4%

    Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.

  25. 9.8CVE-2026-53914EPSS 0.3%

    In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

  26. 7.6CVE-2025-71340EPSS 0.4%

    picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the f…

  27. 7.8CVE-2026-46607EPSS 0.2%

    Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db …

  28. 8.8CVE-2026-56053EPSS 0.5%

    Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

  29. 7.8CVE-2026-10043EPSS 0.5%

    MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to e…

  30. 9.3CVE-2026-56121EPSS 1.4%

    Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function…

  31. 7.6CVE-2025-71354EPSS 0.4%

    picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and exe…

  32. 8.1CVE-2026-54512EPSS 0.9%

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechan…

  33. 8.8CVE-2026-41862EPSS 0.8%

    Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remo…

  34. 8.1CVE-2026-39253EPSS 0.7%

    An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

  35. 7.6CVE-2025-71376EPSS 0.4%

    picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded b…

  36. 7.6CVE-2025-71370EPSS 0.5%

    picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code…

  37. 7.6CVE-2025-71365EPSS 0.4%

    picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detec…

  38. 7.6CVE-2025-71341EPSS 0.6%

    picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx…

  39. 6.3CVE-2026-48517EPSS 0.3%

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangero…

  40. 8.2CVE-2026-48502EPSS 0.4%

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp exte…

  41. 7.6CVE-2025-71358EPSS 0.3%

    picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when…

  42. 7.6CVE-2025-71344EPSS 0.5%

    picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._…

  43. 7.6CVE-2025-71339EPSS 0.4%

    Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when lo…

  44. 9.2CVE-2026-45034EPSS 0.5%

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parse_url($filename, PHP_URL_SCHEME) and then checks is_stri…

  45. 7.6CVE-2025-71378EPSS 0.5%

    picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via…

  46. 7.6CVE-2025-71357EPSS 0.4%

    picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victim…

  47. 7.6CVE-2025-71348EPSS 0.6%

    picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes…

  48. 2.1CVE-2026-12787EPSS 0.4%

    A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization…

  49. 6.9CVE-2026-56304EPSS 0.4%

    picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting mali…

  50. 9.5CVE-2026-48909ExploitEPSS 4.9%

    SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.