CWE-502

2,987 vulnerabilities with CWE-502

CVE-2026-11536 HIGH

IBM WebSphere Application Server is affected by a remote code execution vulnerability

CVSS 8.5

CVE-2026-12118 CRITICAL

IBM webMethods Integration 10.11/10.15 - Unauthenticated Remote Code Execution

CVSS 9.8

CVE-2026-57859 HIGH

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

CVSS 7.5

CVE-2026-1360 HIGH

BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data

CVSS 7.5

CVE-2026-65883 CRITICAL

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

CVE-2026-58163 HIGH

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

CVSS 7.5

CVE-2026-14974 HIGH

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

CVSS 8.1

CVE-2026-14512 CRITICAL

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

CVSS 9.8

CVE-2026-66713 CRITICAL

Apache Axis2/Java: deserialization of untrusted Data

CVSS 9.8

CVE-2026-11756 CRITICAL

Dassault 3DEXPERIENCE Station Launcher R2023x-R2026x - Remote Code Execution

CVSS 10.0

CVE-2026-65617 HIGH

Potential remote code execution on an Artifactory package service container.

CVSS 8.8

CVE-2026-63077 CRITICAL

Jetbrains TeamCity < 2026.1.3, 2025.11.7 - Deserialization of Untrusted Data

CVSS 9.8

CVE-2026-15962 HIGH

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

CVSS 8.8

CVE-2026-50517 CRITICAL

Microsoft M365 Copilot Remote Code Execution Vulnerability

CVSS 9.9

CVE-2026-21655 HIGH

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

CVE-2026-65497 HIGH

WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-65493 HIGH

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

CVSS 7.5

CVE-2026-59544 CRITICAL

WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-16723 CRITICAL

Remote Code Execution in fastjson 1.2.68–1.2.83

CVSS 9.0

CVE-2026-61246 HIGH

Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0 - Authenticated Remote Takeover via HTTP

CVSS 8.8

CVE-2026-60439 HIGH

Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0 - Authenticated Remote Takeover via HTTP

CVSS 8.8

CVE-2026-60373 HIGH

Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0 - Authenticated Remote Takeover via HTTP

CVSS 8.8

CVE-2026-60372 CRITICAL

Oracle Platform Security for Java 12.2.1.4.0/14.1.2.0.0 - Unauth RCE via Thirdparty Jars

CVSS 9.8

CVE-2026-60369 CRITICAL

Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0 - Remote Code Execution via Centralized Thirdparty Jars

CVSS 9.9

CVE-2026-60367 CRITICAL

Oracle Platform Security for Java 12.2.1.4.0, 14.1.2.0.0 - Unauthenticated Remote Code Execution via HTTP

CVSS 9.8