cve.bz

CWE-502: Deserialization of Untrusted Data, page 6

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2026-105872EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

  2. 8.8CVE-2026-104392EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

  3. 7.2CVE-2026-94568EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

  4. 9.8CVE-2026-88131EPSS 1.2%

    Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

  5. 9.8CVE-2026-78406EPSS 0.8%

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  6. 9.8CVE-2026-78401EPSS 0.8%

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  7. 8.8CVE-2026-105436EPSS 0.2%

    Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.

  8. 9.8CVE-2026-93034EPSS 0.5%

    SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this v…

  9. 7.5CVE-2026-82627EPSS 0.3%

    The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untru…

  10. 9.8CVE-2026-95606EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

  11. 8.8CVE-2026-95534EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, T…

  12. 8.8CVE-2026-106558EPSS 0.5%

    Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker …

  13. 9.8CVE-2026-105192EPSS 1.0%

    LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper…

  14. 9.3CVE-2026-107104EPSS 0.4%

    This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the…

  15. 9.4CVE-2025-64393EPSS 5.2%

    This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

  16. 8.8CVE-2026-97188EPSS 0.4%

    The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object …

  17. 7.5CVE-2026-93447EPSS 0.3%

    IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-…

  18. 7.8CVE-2026-65142EPSS 0.2%

    NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disc…

  19. 9.8CVE-2026-76750EPSS 0.5%

    Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected syste…

  20. 7.5CVE-2026-103831EPSS 0.2%

    CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving…

  21. 9.8CVE-2026-39797EPSS 0.3%

    Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

  22. 8.1CVE-2026-104747EPSS 0.2%

    Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

  23. 7.5CVE-2026-82988EPSS 0.5%

    There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenti…

  24. 8.8CVE-2026-97257EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.

  25. 7.2CVE-2026-93617EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

  26. 7.2CVE-2026-103348EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.

  27. 8.8CVE-2026-100511EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

  28. 7.2CVE-2026-100506EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.

  29. 9.8CVE-2026-97283EPSS 0.3%

    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

  30. 7.2CVE-2026-103349EPSS 0.4%

    Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.

  31. 6.1CVE-2026-104905EPSS 0.5%

    FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multi…

  32. 9.8CVE-2026-37719EPSS 0.7%

    An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

  33. 7.3CVE-2019-25777EPSS 0.4%

    YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it…

  34. 9.1CVE-2017-20285EPSS 0.3%

    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY…

  35. 9.8CVE-2026-103877EPSS 0.5%

    Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java cla…

  36. 9.1CVE-2026-55083EPSS 0.6%

    DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code executio…

  37. 7.7CVE-2026-12544EPSS 0.2%

    A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a mul…

  38. 8.8CVE-2026-97284EPSS 0.3%

    Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

  39. 7.2CVE-2026-94390EPSS 0.4%

    Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

  40. 6.6CVE-2026-102135EPSS 1.3%

    On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted serialized object that was deserialized without sufficient validation, potentially allowing code execu…

  41. 7.2CVE-2026-102108EPSS 1.5%

    An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execut…

  42. 8.1CVE-2026-102101EPSS 0.9%

    Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in …

  43. 8.8CVE-2026-97291EPSS 0.3%

    Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.

  44. 7.2CVE-2026-97256EPSS 0.3%

    Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

  45. 7.2CVE-2026-102392EPSS 0.3%

    Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.

  46. 8.8CVE-2026-102377EPSS 0.3%

    Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

  47. 9.8CVE-2026-100512EPSS 0.3%

    Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

  48. 7.2CVE-2026-103441EPSS 0.3%

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

  49. 9.3CVE-2026-103395EPSS 0.6%

    LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and p…

  50. 9.8CVE-2026-97248EPSS 0.4%

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.