CWE-502— Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog
3,714 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-502page 55 of 75
- CVE-2026-22187HIGHCVSS 7.8EG 7.82026-01-07
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo …
- CVE-2025-11157HIGHCVSS 7.8EG 7.82026-01-01
A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at `feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py`. The vulnerability a…
- CVE-2025-15276HIGHCVSS 7.8EG 7.82025-12-31
FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of FontForge. User interaction is required to …
- CVE-2025-13716HIGHCVSS 7.8EG 7.82025-12-23
Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent MimicMotion. User interact…
- CVE-2025-13715HIGHCVSS 7.8EG 7.82025-12-23
Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent FaceDetection-DSFD. User int…
- CVE-2025-13714HIGHCVSS 7.8EG 7.82025-12-23
Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent MedicalNet. User interaction…
- CVE-2025-13713HIGHCVSS 7.8EG 7.82025-12-23
Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent Hunyuan3D-1. User interact…
- CVE-2025-13712HIGHCVSS 7.8EG 7.82025-12-23
Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction is requi…
- CVE-2025-13711HIGHCVSS 7.8EG 7.82025-12-23
Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to expl…
- CVE-2025-13710HIGHCVSS 7.8EG 7.82025-12-23
Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanVideo. User interaction i…
- CVE-2025-13709HIGHCVSS 7.8EG 7.82025-12-23
Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is re…
- CVE-2025-13708HIGHCVSS 7.8EG 7.82025-12-23
Tencent NeuralNLP-NeuralClassifier _load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent NeuralNLP-…
- CVE-2025-13707HIGHCVSS 7.8EG 7.82025-12-23
Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent HunyuanDiT. User interaction i…
- CVE-2025-13706HIGHCVSS 7.8EG 7.82025-12-23
Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent PatrickStar. User interac…
- CVE-2025-14930HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interac…
- CVE-2025-14929HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Tr…
- CVE-2025-14925HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Accelerate. User interaction is r…
- CVE-2025-14924HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Use…
- CVE-2025-14922HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Diffusers. User interacti…
- CVE-2025-14921HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transforme…
- CVE-2025-14920HIGHCVSS 7.8EG 7.82025-12-23
Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. U…
- CVE-2025-33226HIGHCVSS 7.8EG 7.82025-12-16
NVIDIA NeMo Framework for all platforms contains a vulnerability where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, infor…
- CVE-2025-67748HIGHCVSS 7.8EG 7.82025-12-16
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly fl…
- CVE-2025-67747HIGHCVSS 7.8EG 7.82025-12-16
Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows…
- CVE-2025-41700HIGHCVSS 7.8EG 7.82025-12-01
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
- CVE-2025-11622HIGHCVSS 7.8EG 7.82025-10-13
Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges.
- CVE-2025-59050HIGHCVSS 7.8EG 7.82025-09-16
Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, all…
- CVE-2025-41701HIGHCVSS 7.8EG 7.82025-09-09
An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
- CVE-2025-48535HIGHCVSS 7.8EG 7.82025-09-04
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of pr…
- CVE-2025-32312HIGHCVSS 7.8EG 7.82025-09-04
In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege w…
- CVE-2025-9365HIGHCVSS 7.8EG 7.82025-09-03
Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code.
- CVE-2025-7976HIGHCVSS 7.8EG 7.82025-09-02
Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction…
- CVE-2025-9188HIGHCVSS 7.8EG 7.82025-09-02
There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. …
- CVE-2025-23303HIGHCVSS 7.8EG 7.82025-08-13
NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tamper…
- CVE-2025-40759HIGHCVSS 7.8EG 7.82025-08-12
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions < V18 Update 6), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP…
- CVE-2025-26397HIGHCVSS 7.8EG 7.82025-07-24
SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protec…
- CVE-2025-30025HIGHCVSS 7.8EG 7.82025-07-11
The communication protocol used between the server process and the service control had a flaw that could lead to a local privilege escalation.
- CVE-2025-47994HIGHCVSS 7.8EG 7.82025-07-08
Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-53416HIGHCVSS 7.8EG 7.82025-06-30
Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
- CVE-2025-53415HIGHCVSS 7.8EG 7.82025-06-30
Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
- CVE-2025-5174HIGHCVSS 7.8EG 7.82025-05-26
A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to …
- CVE-2025-5173HIGHCVSS 7.8EG 7.82025-05-26
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/lab…
- CVE-2025-30382HIGHCVSS 7.8EG 7.82025-05-13
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2025-34489HIGHCVSS 7.8EG 7.82025-04-28
GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.
- CVE-2024-12742HIGHCVSS 7.8EG 7.82025-03-06
A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file.�…
- CVE-2024-49744HIGHCVSS 7.8EG 7.82025-01-21
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mitigation due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution p…
- CVE-2024-12703HIGHCVSS 7.8EG 7.82025-01-17
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.
- CVE-2025-21364HIGHCVSS 7.8EG 7.82025-01-14
Microsoft Excel Security Feature Bypass Vulnerability
- CVE-2024-13163HIGHCVSS 7.8EG 7.82025-01-14
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is req…
- CVE-2024-12677HIGHCVSS 7.8EG 7.82024-12-20
Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.
Map vulnerabilities like CWE-502 to your infrastructure
EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →