CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,987 vulnerabilities with CWE-502
CVE-2026-54118 HIGH
Microsoft SQL Server Remote Code Execution Vulnerability
CVSS 8.8
CVE-2026-54117 HIGH
Microsoft SQL Server Remote Code Execution Vulnerability
CVSS 8.8
CVE-2026-50652 HIGH
Azure Active Directory Denial of Service Vulnerability
CVSS 7.5
CVE-2026-50522 CRITICAL KEV
Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8
CVE-2026-12583 HIGH
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
CVSS 8.1
CVE-2026-58233 HIGH
SAP ctsattach - Authenticated Deserialization Remote Code Execution
CVSS 7.6
CVE-2026-59521 HIGH
WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability
CVSS 7.2
CVE-2026-59518 CRITICAL
WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57770 CRITICAL
WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57744 CRITICAL
WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57738 CRITICAL
WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57724 CRITICAL
WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57713 HIGH
WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-57371 HIGH
WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-15535 MEDIUM
AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
CVSS 6.3
CVE-2026-15531 MEDIUM
yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
CVSS 5.3
CVE-2026-15529 MEDIUM
yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization
CVSS 6.3
CVE-2026-58281 HIGH
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS 8.3
CVE-2026-55175 HIGH
Spinnaker: Improper yaml processing on kustomize bake operations
CVSS 7.5
CVE-2026-44795 HIGH
Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types
CVSS 8.8
CVE-2026-54469 HIGH
Dell Unisphere For PowerMax - Deserialization of Untrusted Data
CVSS 8.8
CVE-2026-59827 CRITICAL
Metabase: Unsafe Deserialization of H2 Query Results
CVSS 9.9
CVE-2026-54499 HIGH
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
CVSS 7.5
CVE-2026-15105 MEDIUM
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead deserialization
CVSS 6.3
CVE-2026-33264 CRITICAL
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
CVSS 9.8
Details
Vulnerabilities 2,987
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits