CWE-502

2,987 vulnerabilities with CWE-502

CVE-2026-49104 CRITICAL

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-49085 CRITICAL

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-42687 HIGH

WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

CVSS 8.1

CVE-2026-39532 HIGH

WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

CVSS 8.8

CVE-2026-39499 HIGH

WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-39498 HIGH

WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-39481 HIGH

WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-39478 HIGH

WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability

CVSS 8.8

CVE-2026-39474 HIGH

WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability

CVSS 8.8

CVE-2026-39472 HIGH

WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-39471 HIGH

WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-39434 HIGH

WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability

CVSS 7.2

CVE-2026-27333 HIGH

WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability

CVSS 8.1

CVE-2026-27053 CRITICAL

WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability

CVSS 9.8

CVE-2026-39006 CRITICAL

SNMP4J-Agent 3.8.3 - Remote Code Execution via snmp4jCfgStoragePath Component

CVSS 9.8

CVE-2026-11860 HIGH

Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS

CVE-2026-12191 HIGH

Comma AI Openpilot Pickle modeld.py pickle.loads deserialization

CVSS 7.8

CVE-2026-50633 HIGH

Apache CXF JCA Integration - JNDI Injection Remote Code Execution

CVSS 8.1

CVE-2026-50632 HIGH

Apache CXF JMSConfigFactory - JNDI Injection Remote Code Execution

CVSS 8.1

CVE-2026-41699 HIGH

Unsafe Deserialization in Spring GraphQL

CVSS 8.1

CVE-2026-20251 HIGH

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

CVSS 8.8

CVE-2026-53435 HIGH

Jenkins - Deserialization of Untrusted Data

CVSS 8.8

CVE-2026-52751 HIGH

Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection

CVSS 8.8

CVE-2026-10721 HIGH

Concrete CMS < 9.5.2 - PHP Object Injection via unserialize()

CVE-2026-11815 MEDIUM

Insecure Deserialization via MITM in Layer 7 Policy Manager