CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,987 vulnerabilities with CWE-502
CVE-2026-8135 HIGH
Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.
CVSS 7.2
CVE-2026-48207 CRITICAL
Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
CVSS 9.8
CVE-2026-24216 HIGH
NVIDIA BioNeMo Framework < commit dfd83a7 in Main - Deserialization of Untrusted Data
CVSS 7.8
CVE-2026-7637 CRITICAL
Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
CVSS 9.8
CVE-2026-24163 HIGH
NVIDIA TensorRT-LLM < 1.2 - Remote Code Execution via Unsafe RPC Deserialization
CVSS 7.5
CVE-2026-24142 MEDIUM
NVIDIA TensorRT-LLM < 1.2 - Remote Code Execution via Unsafe Deserialization
CVSS 6.3
CVE-2026-6009 HIGH
Jaspersoft Library Deserialisation Vulnerability
CVE-2026-31072 CRITICAL
APScheduler - Remote Code Execution via Insecure Deserialization in JSONSerializer and CBORSerializer
CVSS 9.8
CVE-2026-43633 CRITICAL
HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
CVSS 10.0
CVE-2026-8727 HIGH
Remote Code Execution in extension "Site Crawler" (crawler)
CVE-2026-46725 CRITICAL
Remote Code Execution in extension "Content Element Selector" (ceselector)
CVE-2026-33233 HIGH
AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries
CVSS 7.6
CVE-2026-26978 HIGH
Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php
CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVSS 10.0
CVE-2026-7304 CRITICAL
SGLang - Unauthenticated Remote Code Execution via Pickle Deserialization
CVSS 9.8
CVE-2026-7301 CRITICAL
SGLang - Remote Code Execution
CVSS 9.8
CVE-2026-8751 HIGH
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
CVSS 7.3
CVE-2026-8735 MEDIUM
Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization
CVSS 6.3
CVE-2026-8612 MEDIUM
WWW::Mechanize::Cached < 2.00 - Local Code Execution via Cache Response Forgery
CVSS 5.3
CVE-2026-44501 MEDIUM
DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability
CVSS 4.3
CVE-2026-1184 MEDIUM
Deserialization of Untrusted Data in GitLab
CVSS 6.5
CVE-2026-41957 HIGH
F5 - BIG-IP and BIG-IQ Configuration Utility Vulnerability
CVSS 8.8
CVE-2026-7635 HIGH
coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
CVSS 8.1
CVE-2026-34659 CRITICAL
Adobe Connect | Deserialization of Untrusted Data (CWE-502)
CVSS 9.6
CVE-2026-40368 HIGH
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS 8.0
Details
Vulnerabilities 2,987
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits