CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,711 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 5 of 75

CVE-2026-54858CRITICALCVSS 9.8EG 9.8
2026-10-29
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
CVE-2026-54857CRITICALCVSS 9.8EG 9.8
2026-10-29
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54856CRITICALCVSS 9.8EG 9.8
2026-10-29
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-104317CRITICALCVSS 9.8EG 9.8
2026-10-29
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-115968CRITICALCVSS 9.8EG 9.8
2026-10-28
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
CVE-2026-110879CRITICALCVSS 9.8EG 9.8
2026-10-28
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses…
CVE-2026-114196CRITICALCVSS 9.8EG 9.8
2026-10-24
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
CVE-2026-94075CRITICALCVSS 9.8EG 9.8
2026-10-24
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
CVE-2026-115806CRITICALCVSS 9.8EG 9.8
2026-10-24
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUn…
CVE-2026-112848CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
CVE-2026-112854CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVE-2026-112847CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
CVE-2026-112846CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
CVE-2026-112851CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
CVE-2026-112853CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
CVE-2026-112856CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
CVE-2026-112857CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
CVE-2026-112858CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVE-2026-112859CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
CVE-2026-112855CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVE-2026-112862CRITICALCVSS 9.8EG 9.8
2026-10-23
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
CVE-2026-78162CRITICALCVSS 9.8EG 9.8
2026-10-19
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterC…
CVE-2026-110886CRITICALCVSS 9.8EG 9.8
2026-10-18
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.
CVE-2026-104736CRITICALCVSS 9.8EG 9.8
2026-10-17
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The valu…
CVE-2026-64610CRITICALCVSS 9.8EG 9.8
2026-10-16
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade …
CVE-2026-104730CRITICALCVSS 9.8EG 9.8
2026-10-16
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes …
CVE-2026-111094CRITICALCVSS 9.8EG 9.8
2026-10-15
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
CVE-2026-109686CRITICALCVSS 9.8EG 9.8
2026-10-15
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-55573CRITICALCVSS 9.8EG 9.8
2026-10-14
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting al…
CVE-2026-108291CRITICALCVSS 9.8EG 9.8
2026-10-14
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1.
CVE-2026-49950CRITICALCVSS 9.8EG 9.8
2026-10-13
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.rec…
CVE-2026-81797CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78533CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-78531CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78529CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66569CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
CVE-2026-66568CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
CVE-2026-66567CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66565CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
CVE-2026-66564CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-66482CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-62125CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62090CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →