VulnSea

CWE-502

CVEs classified under CWE-502, newest first.

970 CVEsRSS

CVE-2026-108958Medium· 6.3PoC
3w ago

A weakness has been identified in TensorLayer up to 2.2.4

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to …

▾ TwilightEPSS 0.26%via NVD
CVE-2026-108947Medium· 5.3PoC
3w ago

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5

A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The a…

▾ Twilightyoshitomo-matsubara · torchdistillEPSS 0.20%via NVD
CVE-2026-109361High· 7.3
3w ago

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who c…

▾ TwilightProject-MONAI · MONAIEPSS 0.23%via NVD
CVE-2026-109360High· 7.5PoC
3w ago

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file th…

▾ MidnightProject-MONAI · MONAIEPSS 0.56%via NVD
CVE-2026-109237High· 8.1
3w ago

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_t…

▾ Twilightunclecode · crawl4aiEPSS 0.32%via NVD
CVE-2026-109391High· 8.1
3w ago

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-c…

▾ TwilightSquare · SquashEPSS 0.48%via NVD
CVE-2026-12613High· 8.8
3w ago

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Doc…

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Doc…

▾ TwilightMinistry of Justice General Directorate of Information Technology · UYAP Document EditorEPSS 0.25%via NVD
CVE-2026-52903High· 8.8
3w ago

A deserialization of untrusted data vulnerability was found in ManageIQ

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authentic…

▾ TwilightManageIQ · manageiqEPSS 0.45%via NVD
CVE-2026-81797Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

▾ MidnightThemeRex · Buzz Stone | Magazine & Viral Blog WordPress ThemeEPSS 0.31%via NVD
CVE-2026-78535Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

▾ MidnightThemeRex · PhotoliaEPSS 0.33%via NVD
CVE-2026-78533Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

▾ MidnightAncoraThemes · QweryEPSS 0.33%via NVD
CVE-2026-78531Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

▾ MidnightThemeREX · JacquelineEPSS 0.30%via NVD
CVE-2026-78529Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

▾ MidnightThemeREX · AllianceEPSS 0.30%via NVD
CVE-2026-66569Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

▾ Midnightaxiomthemes · KickerEPSS 0.30%via NVD
CVE-2026-66568Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

▾ Midnightaxiomthemes · OriginalEPSS 0.32%via NVD
CVE-2026-66567Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

▾ MidnightAncoraThemes · AnestaEPSS 0.32%via NVD
CVE-2026-66565Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

▾ Midnightaxiomthemes · FC UnitedEPSS 0.30%via NVD
CVE-2026-66564Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

▾ MidnightThemeREX · ShiftCVEPSS 0.30%via NVD
CVE-2026-66563Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

▾ MidnightThemeREX · WindsorEPSS 0.30%via NVD
CVE-2026-66483Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

▾ MidnightThemeREX · Education CenterEPSS 0.30%via NVD
CVE-2026-66482Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

▾ MidnightAncoraThemes · Drone MediaEPSS 0.30%via NVD
CVE-2026-62130High· 7.2
3w ago

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

▾ TwilightAmir Helzer · woocommerce-multilingualEPSS 0.29%via NVD
CVE-2026-62125Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

▾ MidnightThemeREX · Asia GardenEPSS 0.30%via NVD
CVE-2026-62124Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

▾ MidnightThemeREX · N7 | Golf Club Sports & EventsEPSS 0.30%via NVD
CVE-2026-62123Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

▾ MidnightThemeREX · InvetexEPSS 0.30%via NVD
CVE-2026-62120Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

▾ MidnightThemeREX · Law OfficeEPSS 0.30%via NVD
CVE-2026-62090Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

▾ MidnightThemeREX · WineShopEPSS 0.38%via NVD
CVE-2026-62087Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

▾ MidnightThemeREX · EquadioEPSS 0.38%via NVD
CVE-2026-62086Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

▾ MidnightThemeREX · JunoEPSS 0.38%via NVD
CVE-2026-62077Critical· 9.8
3w ago

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

▾ MidnightBoldThemes · AvalaEPSS 0.38%via NVD
CWE-502 vulnerabilities (CVEs) — page 7 · VulnSea