cve.bz

CWE-502: Deserialization of Untrusted Data, page 17

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2026-49286EPSS 0.7%

    PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP s…

  2. 9.5CVE-2026-12046EPSS 1.0%

    Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module missing the @pga_log…

  3. 7.2CVE-2025-27511EPSS 1.1%

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url lea…

  4. 9.3CVE-2026-8024EPSS 0.6%

    A remote, unauthenticated attacker may exploit a deserialization of untrusted data vulnerability in ibaPDA or ibaDatCoordinator to gain full access to the affected systems.

  5. 9.3CVE-2026-12569KEVEPSS 46%

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS v…

  6. 9.3CVE-2026-53805EPSS 0.9%

    NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Pyth…

  7. 9.3CVE-2026-53874EPSS 0.5%

    picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle …

  8. 9.3CVE-2025-71321EPSS 0.8%

    picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critic…

  9. 9.8CVE-2026-49108EPSS 0.3%

    Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

  10. 8.1CVE-2026-40757EPSS 0.2%

    Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

  11. 8.1CVE-2026-40756EPSS 0.2%

    Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

  12. 8.1CVE-2026-40752EPSS 0.3%

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

  13. 8.1CVE-2026-40738EPSS 0.3%

    Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

  14. 8.1CVE-2026-40733EPSS 0.3%

    Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

  15. 8.1CVE-2026-39576EPSS 0.4%

    Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

  16. 8.1CVE-2026-39560EPSS 0.3%

    Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

  17. 8.1CVE-2026-39556EPSS 0.3%

    Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

  18. 8.1CVE-2026-39445EPSS 0.4%

    Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

  19. 8.1CVE-2026-39442EPSS 0.3%

    Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

  20. 8.8CVE-2025-69130EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Th…

  21. 9.8CVE-2025-69127EPSS 0.4%

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

  22. 9.8CVE-2025-69111EPSS 0.4%

    Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

  23. 9.8CVE-2025-60236EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.

  24. 9.8CVE-2025-60231EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.

  25. 9.8CVE-2025-60230EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.

  26. 9.8CVE-2025-60229EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.

  27. 9.8CVE-2026-54806EPSS 0.7%

    Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

  28. 9.8CVE-2026-54194EPSS 0.4%

    Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

  29. 9.8CVE-2026-52706EPSS 0.5%

    Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

  30. 9.8CVE-2026-49107EPSS 0.4%

    Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

  31. 9.8CVE-2026-49075EPSS 0.4%

    Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

  32. 9.8CVE-2026-42380EPSS 0.5%

    Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

  33. 8.1CVE-2026-40761EPSS 0.2%

    Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

  34. 8.1CVE-2026-40760EPSS 0.2%

    Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

  35. 8.1CVE-2026-40759EPSS 0.3%

    Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

  36. 8.1CVE-2026-40758EPSS 0.3%

    Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

  37. 8.1CVE-2026-40755EPSS 0.2%

    Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

  38. 8.1CVE-2026-40754EPSS 0.2%

    Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

  39. 8.1CVE-2026-40753EPSS 0.3%

    Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

  40. 8.1CVE-2026-40751EPSS 0.3%

    Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

  41. 8.1CVE-2026-40739EPSS 0.3%

    Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

  42. 8.1CVE-2026-40736EPSS 0.2%

    Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

  43. 8.1CVE-2026-40735EPSS 0.4%

    Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

  44. 9.8CVE-2026-40725EPSS 0.4%

    Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

  45. 8.1CVE-2026-39580EPSS 0.2%

    Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

  46. 5.5CVE-2026-39578EPSS 0.3%

    Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

  47. 5.5CVE-2026-39577EPSS 0.2%

    Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

  48. 8.1CVE-2026-39573EPSS 0.4%

    Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

  49. 8.1CVE-2026-39567EPSS 0.3%

    Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

  50. 8.1CVE-2026-39557EPSS 0.4%

    Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.