CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,816 vulnerabilities with CWE-502
CVE-2025-43846 CRITICAL
Retrieval-based-Voice-Conversion-WebUI < 2.2.231006 - Remote Code Execution via Unsafe Torch Deserialization
CVSS 9.8
CVE-2025-4260 MEDIUM
zhangyanbo2007 youkefu <4.2.0 - Deserialization
CVSS 4.3
CVE-2025-46567 MEDIUM
LLaMA-Factory <1.0.0 - Deserialization
CVSS 6.1
CVE-2025-23254 HIGH
NVIDIA TensorRT-LLM - Code Execution
CVSS 8.8
CVE-2025-32444 CRITICAL
vllm 0.6.5-0.8.5 - Remote Code Execution via Pickle Deserialization
CVSS 10.0
CVE-2025-34491 HIGH
GFI MailEssentials < 21.8 - Authenticated Remote Code Execution via .NET Deserialization
CVSS 8.8
CVE-2025-34489 HIGH
GFI MailEssentials < 21.8 - Local Privilege Escalation via .NET Remoting Service Deserialization
CVSS 7.8
CVE-2025-2105 HIGH
Jupiter X Core <4.8.11 - Code Injection
CVSS 8.1
CVE-2025-3935 HIGH KEV
ScreenConnect <25.2.3 - Code Injection
CVSS 8.1
CVE-2025-46481 HIGH
Flickr Shortcode Importer <2.2.3 - Code Injection
CVSS 7.2
CVE-2025-46473 HIGH
djjmz Social Counter <2.0.5 - Code Injection
CVSS 7.2
CVE-2025-23249 HIGH
NVIDIA NeMo < 25.02 - Remote Code Execution via Untrusted Data Deserialization
CVSS 7.6
CVE-2025-3857 HIGH
Amazon.IonDotnet < 1.3.1 - Denial of Service via RawBinaryReader Binary Deserialization
CVSS 7.5
CVE-2025-32434 CRITICAL
PyTorch < 2.6.0 - Remote Code Execution via torch.load with weights_only=True
CVSS 9.8
CVE-2025-29953 CRITICAL
Apache ActiveMQ NMS OpenWire Client <2.1.1 - Deserialization
CVSS 9.8
CVE-2025-39588 CRITICAL
Ultimate Store Kit Elementor Addons <2.4.0 - Code Injection
CVSS 9.8
CVE-2025-39551 CRITICAL
FluentBoards <1.48 - Code Injection
CVSS 9.8
CVE-2025-39550 CRITICAL
Shahjahan Jewel FluentCommunity <1.2.15 - Code Injection
CVSS 9.8
CVE-2025-39527 HIGH
Rating by BestWebSoft <1.7 - Object Injection
CVSS 8.8
CVE-2025-32686 HIGH
WP Speedo Team Members <3.4.0 - Object Injection
CVSS 8.8
CVE-2025-32662 HIGH
Stylemix uListing <2.2.0 - Code Injection
CVSS 8.8
CVE-2025-32658 CRITICAL
wpWax HelpGent <2.2.4 - Code Injection
CVSS 9.8
CVE-2025-32647 HIGH
PickPlugins Question Answer <1.2.70 - Object Injection
CVSS 8.8
CVE-2025-32572 CRITICAL
Climax Themes Kata Plus <1.5.2 - Code Injection
CVSS 9.8
CVE-2025-32571 HIGH
TuriTop Booking System <1.0.10 - Object Injection
CVSS 8.8
Details
Vulnerabilities 2,816
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits