CWE-502

2,987 vulnerabilities with CWE-502

CVE-2026-41732 HIGH

In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

CVSS 8.1

CVE-2026-41731 HIGH

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

CVSS 8.1

CVE-2026-40993 HIGH

Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry

CVSS 7.3

CVE-2026-44963 CRITICAL

Veeam Backup And Replication < 12.3.2 - Deserialization of Untrusted Data

CVE-2026-48560 MEDIUM

Microsoft SharePoint Server Spoofing Vulnerability

CVSS 5.4

CVE-2026-45484 HIGH

Microsoft SharePoint Elevation of Privilege Vulnerability

CVSS 8.8

CVE-2026-26142 CRITICAL

Nuance PowerScribe Remote Code Execution Vulnerability

CVSS 9.8

CVE-2026-49740 MEDIUM

TYPO3 CMS - Insecure Deserialization in Core API

CVE-2026-8365 HIGH

Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field

CVSS 8.8

CVE-2026-41855 HIGH

Spring Framework Unsafe Deserialization via Jackson JMS Converters

CVSS 8.1

CVE-2026-7566 MEDIUM

LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload

CVSS 6.6

CVE-2026-7654 HIGH

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

CVSS 8.8

CVE-2026-50589 MEDIUM

Openstack Ironic < 35.0.1 - Allocation of Resources Without Limits or Throttling

CVSS 5.3

CVE-2026-25551 HIGH

Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service

CVSS 7.8

CVE-2026-25550 CRITICAL

Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

CVSS 9.8

CVE-2026-50076 CRITICAL

Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

CVSS 9.1

CVE-2026-7888 HIGH

Concrete CMS < 9.5.2 - PHP Object Injection

CVE-2026-47065 CRITICAL

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

CVSS 9.8

CVE-2026-42211 HIGH

React Router 7.0.0-7.14.1 - Framework Mode Deserialization Remote Code Execution

CVSS 8.1

CVE-2026-34993 MEDIUM

AIOHTTP Vulnerable to Deserialization of Untrusted Data

CVSS 6.4

CVE-2026-24237 HIGH

Nvidia NVTabular - Deserialization of Untrusted Data

CVSS 7.8

CVE-2026-24221 HIGH

Nvidia NVTabular - Deserialization of Untrusted Data

CVSS 7.8

CVE-2026-39555 HIGH

WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability

CVSS 8.1

CVE-2026-39551 HIGH

WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

CVSS 8.1

CVE-2026-39550 HIGH

WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

CVSS 8.1