cve.bz

CWE-502: Deserialization of Untrusted Data, page 18

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2026-39554EPSS 0.3%

    Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

  2. 8.1CVE-2026-39545EPSS 0.4%

    Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

  3. 8.1CVE-2026-39539EPSS 0.3%

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

  4. 9.8CVE-2026-39529EPSS 0.4%

    Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

  5. 8.1CVE-2026-39446EPSS 0.3%

    Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

  6. 8.1CVE-2026-39443EPSS 0.3%

    Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

  7. 9.8CVE-2026-27429EPSS 0.6%

    Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

  8. 6.5CVE-2026-27410EPSS 0.3%

    Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.

  9. 8.8CVE-2026-12256EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.

  10. 6.6CVE-2026-12115EPSS 0.5%

    The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possibl…

  11. 8.4CVE-2026-11857EPSS 0.3%

    Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound t…

  12. 9.8CVE-2025-69122EPSS 0.5%

    Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

  13. 9.8CVE-2025-69108EPSS 0.5%

    Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

  14. 9.8CVE-2025-60205EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.

  15. 9.8CVE-2026-35300EPSS 0.6%

    Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticat…

  16. 6.8CVE-2026-48775EPSS 0.2%

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint…

  17. 8.6CVE-2026-10748EPSS 0.3%

    An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.

  18. 7.8CVE-2026-24228EPSS 0.2%

    NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and in…

  19. 9.2CVE-2026-48853EPSS 0.8%

    Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows …

  20. 9.8CVE-2026-9691EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

  21. 9.8CVE-2026-49781EPSS 0.5%

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

  22. 9.8CVE-2026-49770EPSS 0.4%

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  23. 9.8CVE-2026-49769EPSS 0.3%

    Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

  24. 9.8CVE-2026-49768EPSS 0.4%

    Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

  25. 9.8CVE-2026-49765EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

  26. 9.8CVE-2026-49763EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

  27. 9.8CVE-2026-49109EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

  28. 9.8CVE-2026-49106EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

  29. 9.8CVE-2026-49105EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  30. 9.8CVE-2026-49104EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

  31. 9.8CVE-2026-49085EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  32. 8.1CVE-2026-42687EPSS 0.3%

    Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

  33. 8.8CVE-2026-39532EPSS 0.3%

    Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

  34. 7.2CVE-2026-39499EPSS 0.4%

    Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.

  35. 7.2CVE-2026-39498EPSS 0.4%

    Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

  36. 7.2CVE-2026-39481EPSS 0.4%

    Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

  37. 8.8CVE-2026-39478EPSS 0.4%

    Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.

  38. 8.8CVE-2026-39474EPSS 0.4%

    Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.

  39. 7.2CVE-2026-39472EPSS 0.4%

    Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.

  40. 7.2CVE-2026-39471EPSS 0.4%

    Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

  41. 7.2CVE-2026-39434EPSS 0.4%

    Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.

  42. 8.1CVE-2026-27333EPSS 0.3%

    Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.

  43. 9.8CVE-2026-27053EPSS 0.4%

    Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

  44. 9.8CVE-2026-39006EPSS 0.5%

    An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

  45. 7.5CVE-2026-11860EPSS 0.2%

    Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. This allows attackers to tamper with serialized payloads in transit and inject malicious objects. Because deserialization …

  46. 7.1CVE-2026-12191EPSS 0.1%

    A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack i…

  47. 8.1CVE-2026-50633EPSS 0.9%

    A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Us…

  48. 8.1CVE-2026-50632EPSS 0.7%

    A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS …

  49. 9.8CVE-2026-41699EPSS 0.4%

    Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a pag…

  50. 8.8CVE-2026-20251EPSS 32%

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a…