CWE-502
CVEs classified under CWE-502, newest first.
904 CVEsRSS
CVE-2026-110879Critical· 9.8jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypass…
CVE-2026-116580High· 7.3Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-75891High· 8.8Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_api…
CVE-2026-115533NoneCVE-2026-115533
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses …
CVE-2026-115190High· 8.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties
An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without rest…
CVE-2026-116230Medium· 6.3Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization
A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be pe…
CVE-2026-116098Medium· 6.3SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserializati…
CVE-2026-114704High· 7.2WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
CVE-2026-94075Critical· 9.8WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-114196Critical· 9.8WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
CVE-2026-115806Critical· 9.8Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUn…
CVE-2026-57845High· 8.8PoCHugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Atta…
CVE-2026-114624High· 7.2PoCbaserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON A…
CVE-2026-112854Critical· 9.8WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVE-2026-112859Critical· 9.8WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
CVE-2026-112855Critical· 9.8WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVE-2026-112858Critical· 9.8WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVE-2026-112856Critical· 9.8WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
CVE-2026-112857Critical· 9.8WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
CVE-2026-112853Critical· 9.8WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
CVE-2026-112852High· 8.1WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
CVE-2026-112851Critical· 9.8WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
CVE-2026-112848Critical· 9.8WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
CVE-2026-112846Critical· 9.8WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
CVE-2026-112847Critical· 9.8WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
CVE-2026-112862Critical· 9.8WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
CVE-2025-30047Critical· 9.4Remote Code Execution via Java Deserialization in CGM CLININET
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker wi…
CVE-2026-16477High· 8.4Insecure Deserialization of .cleanshot Files in CleanShot X
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and h…
CVE-2026-114608Medium· 5.4Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, gr…