VulnSea

CWE-502

CVEs classified under CWE-502, newest first.

869 CVEsRSS

CVE-2026-75891High· 8.8
today

Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_api…

▾ Twilightthemeum · Kirki – Freeform Page Builder, Website Builder & CustomizerEPSS 0.30%via CVEORG
CVE-2026-114608Medium· 5.4
today

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

▾ Sunlitpylint · pylintEPSS 0.11%via OSV
CVE-2026-115533None
yesterday

CVE-2026-115533

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses …

▾ SunlitHugging Face · LeRobotEPSS 0.34%via CVEORG
CVE-2026-116580High· 7.3
yesterday

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring sou…

▾ Twilightlxsmnsyc · serovalEPSS 0.34%via CVEORG
CVE-2026-115912High· 7.5
yesterday

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployment…

▾ Twilightvllm-project · vllmEPSS 0.48%via CVEORG
CVE-2026-115190High· 8.0
yesterday

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without rest…

▾ TwilightEPSS 0.49%via CVEORG
CVE-2026-116230Medium· 6.3
yesterday

Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be pe…

▾ SunlitNdemic Creations · Plague Inc EvolvedEPSS 0.26%via CVEORG
CVE-2026-116098Medium· 6.3
2d ago

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserializati…

▾ SunlitSteelRaven7 · RavenfieldEPSS 0.26%via CVEORG
CVE-2026-114704High· 7.2
3d ago

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

▾ TwilightChristoph Vielgrader · relevanssiEPSS 0.41%via CVEORG
CVE-2026-94075Critical· 9.8
3d ago

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

▾ MidnightTribulant Software · newsletters-liteEPSS 0.56%via CVEORG
CVE-2026-114196Critical· 9.8
3d ago

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.

▾ Midnightpaytiumsupport · paytiumEPSS 0.45%via CVEORG
CVE-2026-115806Critical· 9.8
3d ago

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUn…

▾ Midnightcodexonics · Prime Mover – Backup and MigrationEPSS 0.55%via CVEORG
CVE-2026-57845High· 8.8PoC
4d ago

Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Atta…

▾ Midnighthuggingface · datasetsEPSS 0.55%via CVEORG
CVE-2026-114624High· 7.2
4d ago

baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON A…

▾ Twilightbaserproject · basercmsEPSS 0.61%via CVEORG
CVE-2026-112854Critical· 9.8
4d ago

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

▾ Midnightaxiomthemes · holistic-centerEPSS 0.31%via CVEORG
CVE-2026-112859Critical· 9.8
4d ago

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

▾ MidnightThemeREX Group · little-birdiesEPSS 0.31%via CVEORG
CVE-2026-112855Critical· 9.8
4d ago

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

▾ Midnightaxiomthemes · redyEPSS 0.31%via CVEORG
CVE-2026-112858Critical· 9.8
4d ago

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

▾ Midnightaxiomthemes · rhodosEPSS 0.31%via CVEORG
CVE-2026-112856Critical· 9.8
4d ago

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

▾ MidnightThemeREX Group · vagabondsEPSS 0.31%via CVEORG
CVE-2026-112857Critical· 9.8
4d ago

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

▾ Midnightaxiomthemes · reprizoEPSS 0.41%via CVEORG
CVE-2026-112853Critical· 9.8
4d ago

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

▾ Midnightaxiomthemes · hallelujahEPSS 0.41%via CVEORG
CVE-2026-112852High· 8.1
4d ago

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

▾ TwilightThemeREX Group · helionEPSS 0.26%via CVEORG
CVE-2026-112851Critical· 9.8
4d ago

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

▾ MidnightThemeREX Group · hotlockEPSS 0.31%via CVEORG
CVE-2026-112848Critical· 9.8
4d ago

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

▾ MidnightAivahThemes · hostmev2EPSS 0.31%via CVEORG
CVE-2026-112846Critical· 9.8
4d ago

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

▾ MidnightThemeREX Group · save-lifeEPSS 0.31%via CVEORG
CVE-2026-112847Critical· 9.8
4d ago

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

▾ MidnightThemeREX · zensoulEPSS 0.31%via CVEORG
CVE-2026-112862Critical· 9.8
4d ago

WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

▾ Midnightxnau webdesign · participants-databaseEPSS 0.41%via CVEORG
CVE-2025-30047Critical· 9.4
4d ago

Remote Code Execution via Java Deserialization in CGM CLININET

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker wi…

▾ MidnightCGM · CGM CLININETEPSS 0.38%via CVEORG
CVE-2026-16477High· 8.4
5d ago

Insecure Deserialization of .cleanshot Files in CleanShot X

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and h…

▾ TwilightMTW · CleanShot XEPSS 0.29%via CVEORG
GHSA-673q-mjm6-r5xrCritical
5d ago

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

▾ Midnightnext · nextvia GHSA
CWE-502 vulnerabilities (CVEs) · VulnSea