CWE-502
CVEs classified under CWE-502, newest first.
974 CVEsRSS
CVE-2026-97256High· 7.2Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
CVE-2026-100512Critical· 9.8Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
CVE-2026-103441High· 7.2PoCDeserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
CVE-2026-103395Critical· 9.8PoCLightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and…
CVE-2026-93624High· 7.2Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
CVE-2026-94076High· 8.8Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
CVE-2026-93651High· 7.2Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
CVE-2026-93771High· 7.2Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
CVE-2026-94121High· 8.8Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
CVE-2026-94122High· 7.2Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
CVE-2026-94678High· 8.8Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
CVE-2026-94677High· 7.2Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
CVE-2026-95531High· 8.8Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
CVE-2026-94683High· 8.8Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
CVE-2026-96344High· 7.2Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
CVE-2026-96343High· 7.2Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
CVE-2026-96831High· 8.8Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
CVE-2026-96833High· 7.2Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
CVE-2026-96832High· 7.2Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
CVE-2026-97246Medium· 4.9Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
CVE-2026-97248Critical· 9.8Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
CVE-2026-102455Critical· 9.8EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
CVE-2026-91051Medium· 6.6The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them …
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them …
CVE-2026-13046High· 7.2A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code …
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code …
CVE-2026-103041Critical· 9.8PoCLightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary…
CVE-2026-103040Critical· 9.8PoCLightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allow…
CVE-2026-100308High· 7.8Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a craf…
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a craf…
CVE-2026-101169High· 8.7In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execut…
CVE-2026-81867Critical· 9.4A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrar…
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrar…
CVE-2026-82384Critical· 9.8PoCDeserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized d…
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized d…