CWE-502

Medium likelihood

Deserialization of Untrusted Data

Parent: CWE-913 - Improper Control of Dynamically-Managed Code Resources

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

2,593 vulnerabilities with CWE-502
CVE-2026-22510 HIGH
WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability
CVSS 8.1
CVE-2026-22507 CRITICAL
WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-22505 HIGH
WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability
CVSS 8.1
CVE-2026-22500 CRITICAL
WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-22480 HIGH
WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability
CVSS 7.2
CVE-2026-24159 HIGH
Nvidia Nemo Framework - Remote Code Execution
CVSS 7.8
CVE-2026-24157 HIGH
Nvidia Nemo Framework - Remote Code Execution
CVSS 7.8
CVE-2026-24152 HIGH
Nvidia Megatron LM - Information Disclosure
CVSS 7.8
CVE-2026-24151 HIGH
Nvidia Megatron LM - Information Disclosure
CVSS 7.8
CVE-2026-24150 HIGH
Nvidia Megatron LM - Information Disclosure
CVSS 7.8
CVE-2026-24141 HIGH
Nvidia Model Optimizer - Information Disclosure
CVSS 7.8
CVE-2026-4735 HIGH
A stack overflow and DoS vulnerability in DTStack/chunjun
CVE-2026-4538 MEDIUM
PyTorch pt2 Loading deserialization
CVSS 5.3
CVE-2026-0677 HIGH
WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability
CVSS 7.2
CVE-2026-29109 HIGH
SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
CVSS 7.2
CVE-2026-25445 HIGH
WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability
CVSS 8.8
CVE-2026-27096 HIGH
WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability
CVSS 8.1
CVE-2026-25873 CRITICAL
OmniGen2-RL Reward Server Unsafe Deserialization RCE
CVSS 9.8
CVE-2026-25449 CRITICAL
WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability
CVSS 9.8
CVE-2026-25769 CRITICAL
Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization
CVSS 9.1
CVE-2026-1323 HIGH
Insecure Deserialization in extension "Mailqueue" (mailqueue)
CVSS 8.8
CVE-2026-32355 HIGH
Crocoblock JetEngine <3.8.4.1 - Deserialization
CVSS 8.8
CVE-2026-3060 CRITICAL
SGLang - Deserialization RCE
CVSS 9.8
CVE-2026-3059 CRITICAL
SGLang Multimodal Module - Deserialization
CVSS 9.8
CVE-2026-3967 MEDIUM
Alfresco Activiti <7.19/8.8.0 - Deserialization
CVSS 6.3
Details
Vulnerabilities 2,593
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits