CWE-502

2,593 vulnerabilities with CWE-502

CVE-2026-5659 MEDIUM

pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization

CVSS 6.3

CVE-2026-5536 HIGH

FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization

CVSS 7.3

CVE-2026-5473 MEDIUM

NASA cFS Pickle pickle.load deserialization

CVSS 4.5

CVE-2026-35537 LOW

Roundcube Webmail <1.5.14 - Deserialization

CVSS 3.7

CVE-2026-34838 CRITICAL

Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

CVSS 9.9

CVE-2026-34877 CRITICAL

Mbed TLS 2.19.0-3.6.5, 4.0.0 - Memory Corruption

CVSS 9.8

CVE-2026-29782 HIGH

OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

CVSS 7.2

CVE-2026-24165 HIGH

Nvidia Bionemo Framework - Denial of Service

CVSS 7.8

CVE-2026-24164 HIGH

Nvidia Bionemo Framework - Denial of Service

CVSS 8.8

CVE-2026-34202 HIGH

Zebra node crash — V5 transaction hash panic (P2P reachable)

CVSS 7.5

CVE-2026-4266 HIGH

WatchGuard Firebox Insecure Deserialization in Fireware Access Portal

CVE-2026-4416 HIGH

GIGABYTE｜Performance Library - Insecure Deserialization

CVSS 7.8

CVE-2026-4851 CRITICAL

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization

CVSS 9.8

CVE-2026-33728 CRITICAL

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution

CVE-2026-33725 HIGH

Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

CVSS 7.2

CVE-2026-33701 CRITICAL

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

CVSS 9.8

CVE-2026-4860 HIGH

648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization

CVSS 7.3

CVE-2026-3328 HIGH

Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts

CVSS 7.2

CVE-2026-33942 CRITICAL

Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE)

CVSS 9.8

CVE-2026-32513 HIGH

WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability

CVSS 8.8

CVE-2026-32512 CRITICAL

WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-32511 MEDIUM

WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability

CVSS 5.4

CVE-2026-32510 MEDIUM

WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

CVSS 5.4

CVE-2026-32509 MEDIUM

WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability

CVSS 5.4

CVE-2026-32508 MEDIUM

WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability

CVSS 5.4