CWE-502
CVEs classified under CWE-502, newest first.
968 CVEsRSS
CVE-2026-110874Medium· 6.6Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, …
CVE-2026-110812Critical· 9.9Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service cred…
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service cred…
CVE-2026-111094High· 8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-47168Critical· 9.1EspoCRM is an open source customer relationship management application
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later d…
CVE-2026-109686Critical· 9.8Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-102469Critical· 9.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a …
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a …
CVE-2026-110761High· 8.8ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a m…
CVE-2026-55573Critical· 9.8PoCe107 is a content management system (CMS)
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting …
CVE-2026-97278High· 7.2Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
CVE-2026-108291Critical· 9.8Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
CVE-2026-106599High· 8.8Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.
CVE-2026-73793High· 7.9HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
CVE-2026-104764High· 7.2The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input
The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with a…
CVE-2026-93905High· 8.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-65674High· 8.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-49950Critical· 9.8Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.r…
CVE-2026-105442High· 7.5IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messa…
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messa…
CVE-2026-96186High· 7.8Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CVE-2026-88091High· 7.8Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
CVE-2026-87697High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-87692High· 7.8Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-85900High· 8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-83520High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70035High· 8.8Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-105013High· 7.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-100214High· 8.8Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
CVE-2026-65180High· 7.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalati…
CVE-2026-65110High· 7.8NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, esc…
CVE-2026-108958Medium· 6.3PoCA weakness has been identified in TensorLayer up to 2.2.4
A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to …
CVE-2026-108947Medium· 5.3PoCA flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5
A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The a…