cve.bz

CWE-502: Deserialization of Untrusted Data, page 2

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.7CVE-2026-119120EPSS 0.4%

    Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malic…

  2. 8.8CVE-2026-118081EPSS 0.4%

    Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

  3. 8.8CVE-2026-118080EPSS 0.4%

    Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

  4. 7.2CVE-2026-118079EPSS 0.3%

    Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

  5. 7.2CVE-2026-118078EPSS 0.3%

    Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

  6. 7.2CVE-2026-118077EPSS 0.3%

    Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

  7. 8.8CVE-2026-118076EPSS 0.4%

    Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

  8. 8.8CVE-2026-118075EPSS 0.4%

    Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

  9. 7.2CVE-2026-118074EPSS 0.3%

    Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

  10. 8.8CVE-2026-118073EPSS 0.4%

    Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

  11. 7.2CVE-2026-116869EPSS 0.3%

    Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

  12. 8.8CVE-2026-116868EPSS 0.4%

    Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

  13. 8.8CVE-2026-116867EPSS 0.4%

    Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

  14. 8.8CVE-2026-116866EPSS 0.3%

    Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

  15. 7.2CVE-2026-116865EPSS 0.3%

    Editor PHP Object Injection in Zippy <= 1.7.0 versions.

  16. 7.2CVE-2026-116864EPSS 0.3%

    Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

  17. 8.8CVE-2026-104324EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

  18. 9.8CVE-2026-104317EPSS 0.6%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

  19. 9.0CVE-2026-103693EPSS 0.5%

    The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is v…

  20. 7.8CVE-2026-118617EPSS 0.3%

    Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is r…

  21. 7.8CVE-2026-118613EPSS 0.2%

    Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to ex…

  22. 7.2CVE-2026-116390EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything&nbsp;— WordPress &amp; WooCommerce Fil…

  23. 8.8CVE-2026-116389EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.

  24. 9.8CVE-2026-115968EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

  25. 7.2CVE-2026-115590EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.

  26. 7.2CVE-2026-116392EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.

  27. 8.8CVE-2026-116391EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.

  28. 8.8CVE-2026-1928EPSS 0.5%

    The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. …

  29. 9.8CVE-2026-110879EPSS 1.2%

    jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses…

  30. 8.8CVE-2026-75891EPSS 0.3%

    The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis(…

  31. 7.3CVE-2026-116580EPSS 0.3%

    Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring sourc…

  32. 8.8CVE-2026-115912EPSS 0.5%

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments …

  33. 8.0CVE-2026-115190EPSS 0.5%

    An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restri…

  34. 2.1CVE-2026-116230EPSS 0.3%

    A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be perf…

  35. 5.3CVE-2026-116098EPSS 0.3%

    A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization…

  36. 7.2CVE-2026-114704EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

  37. 9.8CVE-2026-94075EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

  38. 9.8CVE-2026-114196EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

  39. 9.8CVE-2026-115806EPSS 0.5%

    The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnse…

  40. 8.7CVE-2026-57845EPSS 0.5%

    Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attack…

  41. 7.2CVE-2026-114624EPSS 0.9%

    baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API…

  42. 9.8CVE-2026-112859EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

  43. 9.8CVE-2026-112858EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

  44. 9.8CVE-2026-112857EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

  45. 9.8CVE-2026-112856EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

  46. 9.8CVE-2026-112855EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

  47. 9.8CVE-2026-112854EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

  48. 9.8CVE-2026-112853EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

  49. 8.1CVE-2026-112852EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

  50. 9.8CVE-2026-112851EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.