CWE-502

2,743 vulnerabilities with CWE-502

CVE-2026-1691 MEDIUM

bolo-solo < 2.6.4 - Remote Code Execution via SnakeYAML Deserialization

CVSS 6.3

CVE-2026-24765 HIGH

PHPUnit < 8.5.52 - Remote Code Execution via Unsafe Deserialization in PHPT Coverage Cleanup

CVSS 7.8

CVE-2026-24747 HIGH

PyTorch < 2.10.0 - Remote Code Execution via Malicious Checkpoint File

CVSS 8.8

CVE-2026-24815 CRITICAL

datavane tis <4.3.0 - Deserialization

CVE-2026-23864 HIGH

React Server Components 19.0.0-19.0.3, 19.1.0-19.1.4, 19.2.0-19.2.3 - DoS via Crafted HTTP Requests

CVSS 7.5

CVE-2026-24656 LOW

Apache Karaf Decanter - Deserialization

CVSS 3.7

CVE-2026-0773 CRITICAL

Upsonic - Unauthenticated Remote Code Execution via Cloudpickle Deserialization in add_tool Endpoint

CVSS 9.8

CVE-2026-0772 HIGH

Langflow Disk Cache - Deserialization

CVSS 7.5

CVE-2026-0764 CRITICAL

GPT Academic - Unauthenticated Remote Code Execution via Upload Endpoint Deserialization

CVSS 9.8

CVE-2026-0763 CRITICAL

GPT Academic - Unauthenticated Remote Code Execution via run_in_subprocess_wrapper_func Deserialization

CVSS 9.8

CVE-2026-0762 HIGH

GPT Academic - Remote Code Execution via Untrusted Data Deserialization in stream_daas

CVSS 8.1

CVE-2026-0760 CRITICAL

Foundation Agents MetaGPT - Deserialization

CVSS 9.8

CVE-2026-24009 HIGH

docling-core 2.21.0-2.48.4 - Remote Code Execution via PyYAML Deserialization

CVSS 8.1

CVE-2026-23946 MEDIUM

Tendenci <15.3.11 - Authenticated RCE

CVSS 6.8

CVE-2026-23737 HIGH

seroval < 1.4.1 - Remote Code Execution via JSON Deserialization

CVSS 7.5

CVE-2026-23524 CRITICAL

Laravel Reverb < 1.7.0 - Remote Code Execution via Unsafe Redis Data Deserialization

CVSS 9.8

CVE-2026-0726 HIGH

Nexter Extension - Site Enhancements Toolkit <4.4.6 - Code Injection

CVSS 8.1

CVE-2026-0895 MEDIUM

TYPO3 Extension Mailqueue < 0.4.3 and 0.5.0 < 0.5.1 - Insecure Deserialization

CVE-2026-23746 CRITICAL

Entrust Instant Financial Issuance (IFI) On Premise <6.10.5-6.11.1 ...

CVE-2026-21226 HIGH

Azure Core Shared Client Library for Python < 1.38.0 - Remote Code Execution via Untrusted Data Deserialization

CVSS 7.5

CVE-2026-20963 CRITICAL KEV

Microsoft Office SharePoint - Code Injection

CVSS 9.8

CVE-2026-0859 HIGH

Typo3 < 10.4.55 - Insecure Deserialization

CVSS 7.8

CVE-2026-22612 HIGH

fickling < 0.1.7 - Detection Bypass via Builtins Blindness

CVSS 7.8

CVE-2026-22609 HIGH

fickling < 0.1.7 - Incomplete List of Disallowed Inputs in unsafe_imports()

CVSS 7.8

CVE-2026-22608 HIGH

fickling < 0.1.7 - Remote Code Execution via Unblocked ctypes and pydoc Modules

CVSS 7.8