cve.bz

CWE-502: Deserialization of Untrusted Data, page 4

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-111094EPSS 0.4%

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

  2. 9.1CVE-2026-47168EPSS 0.4%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later des…

  3. 9.8CVE-2026-109686EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

  4. 9.2CVE-2026-102469EPSS 0.5%

    In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a ba…

  5. 8.7CVE-2026-110761EPSS 0.6%

    ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a mal…

  6. 9.8CVE-2026-55573EPSS 0.7%

    e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting al…

  7. 7.2CVE-2026-97278EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.

  8. 9.8CVE-2026-108291EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.

  9. 8.8CVE-2026-106599EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

  10. 7.9CVE-2026-73793EPSS 0.3%

    HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.

  11. 7.2CVE-2026-104764EPSS 0.6%

    The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with adm…

  12. 8.2CVE-2026-93905EPSS 0.3%

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

  13. 8.8CVE-2026-65674EPSS 1.6%

    Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

  14. 9.3CVE-2026-49950EPSS 0.9%

    Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.rec…

  15. 7.5CVE-2026-105442EPSS 0.4%

    IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messagi…

  16. 7.8CVE-2026-96186EPSS 2.4%

    Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-88091EPSS 2.9%

    Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-87697EPSS 0.8%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  19. 7.8CVE-2026-87692EPSS 2.3%

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

  20. 8.8CVE-2026-85900EPSS 1.5%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  21. 8.8CVE-2026-83520EPSS 1.4%

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  22. 8.8CVE-2026-70035EPSS 1.4%

    Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

  23. 7.4CVE-2026-105013EPSS 1.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  24. 8.8CVE-2026-100214EPSS 2.1%

    Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.

  25. 7.8CVE-2026-65180EPSS 0.2%

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation…

  26. 7.8CVE-2026-65110EPSS 0.2%

    NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escal…

  27. 2.1CVE-2026-108958EPSS 0.3%

    A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to de…

  28. 1.9CVE-2026-108947EPSS 0.2%

    A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The att…

  29. 7.0CVE-2026-109361EPSS 0.2%

    MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can…

  30. 7.7CVE-2026-109360EPSS 0.6%

    MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that…

  31. 8.6CVE-2026-109237EPSS 0.3%

    Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_tok…

  32. 9.2CVE-2026-109391EPSS 0.5%

    Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-con…

  33. 8.8CVE-2026-12613EPSS 0.3%

    Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Docum…

  34. 8.8CVE-2026-52903EPSS 0.4%

    A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticat…

  35. 9.8CVE-2026-81797EPSS 0.3%

    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

  36. 9.8CVE-2026-78535EPSS 0.3%

    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

  37. 9.8CVE-2026-78533EPSS 0.3%

    Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

  38. 9.8CVE-2026-78531EPSS 0.3%

    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

  39. 9.8CVE-2026-78529EPSS 0.3%

    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

  40. 9.8CVE-2026-66569EPSS 0.3%

    Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

  41. 9.8CVE-2026-66568EPSS 0.3%

    Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

  42. 9.8CVE-2026-66567EPSS 0.3%

    Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

  43. 9.8CVE-2026-66565EPSS 0.3%

    Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

  44. 9.8CVE-2026-66564EPSS 0.3%

    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

  45. 9.8CVE-2026-66563EPSS 0.3%

    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

  46. 9.8CVE-2026-66483EPSS 0.3%

    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

  47. 9.8CVE-2026-66482EPSS 0.3%

    Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

  48. 7.2CVE-2026-62130EPSS 0.3%

    Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

  49. 9.8CVE-2026-62125EPSS 0.3%

    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

  50. 9.8CVE-2026-62124EPSS 0.3%

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.