CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,987 vulnerabilities with CWE-502
CVE-2026-43825 HIGH
Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel
CVSS 7.3
CVE-2026-46590 HIGH
Apache Camel PQC - Key Metadata Deserialization
CVSS 8.8
CVE-2026-43867 CRITICAL
Apache Camel PQC - AWS Secrets Manager Metadata Deserialization
CVSS 9.8
CVE-2026-43866 HIGH
Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder
CVSS 7.3
CVE-2026-43865 HIGH
Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution
CVSS 8.1
CVE-2026-42527 HIGH
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
CVSS 8.1
CVE-2026-40859 HIGH
Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
CVSS 8.1
CVE-2026-14723 MEDIUM
AD-Security AD_Miner Cache analyse_cache.py request_a deserialization
CVSS 5.3
CVE-2026-14637 HIGH
kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
CVSS 8.2
CVE-2026-14534 HIGH
Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
CVSS 8.8
CVE-2026-12481 CRITICAL
Deserialization of Untrusted Data in keras-team/keras
CVSS 9.8
CVE-2026-13371 MEDIUM
WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization
CVE-2026-57677 CRITICAL
WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-57621 CRITICAL
WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-56037 HIGH
WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-27414 HIGH
WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-27060 HIGH
WordPress ARMember Premium plugin <= 7.0 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-55153 HIGH
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
CVSS 7.1
CVE-2026-14265 HIGH
RCE via Deserialization in AWS Advanced JDBC Wrapper
CVSS 7.5
CVE-2026-51947 CRITICAL
Pivotal CRM 6.6.4.08 - Remote Code Execution via Pivotal.Engine.Client.Services.Conversion.dll
CVSS 9.8
CVE-2026-57516 HIGH
Ray < 2.56.0 WebDataset Reader - Remote Code Execution
CVSS 8.8
CVE-2026-58127 CRITICAL
PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
CVSS 9.8
CVE-2026-58126 CRITICAL
PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
CVSS 9.8
CVE-2026-58025 CRITICAL
Remote Code Execution via Unsafe Deserialization in LogItem Import
CVSS 9.8
CVE-2026-24251 HIGH
Nvidia Megatron-Bridge - Deserialization of Untrusted Data
CVSS 7.8
Details
Vulnerabilities 2,987
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits