cve.bz

CWE-502: Deserialization of Untrusted Data, page 7

Filter

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

What the weakness is: CWE-502 at MITRE

Ask an AI about CWE-502

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-502: Deserialization of Untrusted Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/502.html and https://cve.bz/cve/cwe/502?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2026-97246EPSS 0.2%

    Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

  2. 7.2CVE-2026-96833EPSS 0.4%

    Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

  3. 7.2CVE-2026-96832EPSS 0.4%

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

  4. 8.8CVE-2026-96831EPSS 0.3%

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

  5. 7.2CVE-2026-96344EPSS 0.4%

    Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

  6. 7.2CVE-2026-96343EPSS 0.4%

    Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

  7. 8.8CVE-2026-95531EPSS 0.5%

    Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

  8. 8.8CVE-2026-94683EPSS 0.3%

    Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

  9. 8.8CVE-2026-94678EPSS 0.4%

    Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

  10. 7.2CVE-2026-94677EPSS 0.4%

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

  11. 7.2CVE-2026-94122EPSS 0.4%

    Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

  12. 8.8CVE-2026-94121EPSS 0.4%

    Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

  13. 8.8CVE-2026-94076EPSS 0.3%

    Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

  14. 7.2CVE-2026-93771EPSS 0.4%

    Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

  15. 7.2CVE-2026-93651EPSS 0.4%

    Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

  16. 7.2CVE-2026-93624EPSS 0.4%

    Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

  17. 9.3CVE-2026-102455EPSS 0.5%

    EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

  18. 6.6CVE-2026-91051EPSS 0.3%

    The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to…

  19. 7.5CVE-2026-13046EPSS 0.4%

    A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in…

  20. 9.3CVE-2026-103041EPSS 0.8%

    LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary c…

  21. 9.3CVE-2026-103040EPSS 1.0%

    LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowin…

  22. 8.4CVE-2026-100308EPSS 0.1%

    Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafte…

  23. 8.7CVE-2026-101169EPSS 0.3%

    In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute …

  24. 9.4CVE-2026-81867EPSS 0.4%

    A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary …

  25. 9.8CVE-2026-82384EPSS 1.0%

    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized dur…

  26. 4.7CVE-2026-86841EPSS 0.2%

    The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users grant…

  27. 8.8CVE-2026-100846EPSS 0.4%

    MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data …

  28. 8.5CVE-2026-100845EPSS 0.2%

    MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle…

  29. 8.5CVE-2026-100843EPSS 0.3%

    MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute …

  30. 8.5CVE-2026-100841EPSS 0.1%

    In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, …

  31. 1.2CVE-2026-97869EPSS 0.2%

    A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-age…

  32. 7.2CVE-2026-84862EPSS 0.4%

    IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.

  33. 6.9CVE-2026-97865EPSS 0.4%

    A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. …

  34. 6.3CVE-2026-96745EPSS 0.3%

    Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a…

  35. 3.4CVE-2026-63630EPSS 0.4%

    BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the craft…

  36. 8.8CVE-2026-82093EPSS 0.4%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.

  37. 7.5CVE-2026-80513EPSS 0.3%

    The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PH…

  38. 7.2CVE-2026-95603EPSS 0.5%

    Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

  39. 8.8CVE-2026-96804EPSS 0.7%

    MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

  40. 8.8CVE-2026-96775EPSS 0.6%

    MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

  41. 8.8CVE-2026-18490EPSS 0.8%

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95…

  42. 9.3CVE-2026-96560EPSS 1.2%

    LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attacke…

  43. 2.0CVE-2026-95928EPSS 0.3%

    A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation r…

  44. 2.0CVE-2026-95897EPSS 0.2%

    A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remo…

  45. 9.8CVE-2026-18163EPSS 0.8%

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

  46. 8.8CVE-2026-17637EPSS 0.7%

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.

  47. 8.7CVE-2026-67615EPSS 0.5%

    openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*.…

  48. 8.8CVE-2026-28325EPSS 1.5%

    SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

  49. 9.2CVE-2026-43642EPSS 1.0%

    Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserializatio…

  50. 7.7CVE-2026-83803EPSS 0.6%

    Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. A…