CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,711 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 6 of 75

CVE-2026-62086CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62077CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
CVE-2026-62076CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
CVE-2026-62054CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-42723CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2026-42719CRITICALCVSS 9.8EG 9.8
2026-10-10
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
CVE-2026-42718CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
CVE-2026-42716CRITICALCVSS 9.8EG 9.8
2026-10-10
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVE-2026-104398CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a t…
CVE-2026-62045CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
CVE-2026-62046CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
CVE-2026-93945CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
CVE-2026-93944CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
CVE-2026-93943CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
CVE-2026-93942CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
CVE-2026-93941CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
CVE-2026-93940CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
CVE-2026-93938CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
CVE-2026-93937CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
CVE-2026-93936CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
CVE-2026-93935CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
CVE-2026-93934CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
CVE-2026-93933CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
CVE-2026-93932CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
CVE-2026-93931CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
CVE-2026-93930CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
CVE-2026-93929CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
CVE-2026-93927CRITICALCVSS 9.8EG 9.8
2026-10-10
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
CVE-2026-100730CRITICALCVSS 9.8EG 9.8
2026-10-09
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows A…
CVE-2026-88131CRITICALCVSS 9.8EG 9.8
2026-10-08
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
CVE-2026-78401CRITICALCVSS 9.8EG 9.8
2026-10-08
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-78406CRITICALCVSS 9.8EG 9.8
2026-10-08
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-93034CRITICALCVSS 9.8EG 9.8
2026-10-08
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this v…
CVE-2026-95606CRITICALCVSS 9.8EG 9.8
2026-10-07
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
CVE-2026-105192CRITICALCVSS 9.8EG 9.8
2026-10-07
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper…
CVE-2026-76750CRITICALCVSS 9.8EG 9.8
2026-10-06
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected syste…
CVE-2026-39797CRITICALCVSS 9.8EG 9.8
2026-10-06
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
CVE-2026-97283CRITICALCVSS 9.8EG 9.8
2026-10-05
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
CVE-2026-37719CRITICALCVSS 9.8EG 9.8
2026-10-05
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
CVE-2026-103877CRITICALCVSS 9.8EG 9.8
2026-10-02
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a serialized Java cla…
CVE-2026-100512CRITICALCVSS 9.8EG 9.8
2026-09-30
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
CVE-2026-103395CRITICALCVSS 9.8EG 9.8
2026-09-30
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and p…
CVE-2026-97248CRITICALCVSS 9.8EG 9.8
2026-09-30
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
CVE-2026-102455CRITICALCVSS 9.8EG 9.8
2026-09-30
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
CVE-2026-103041CRITICALCVSS 9.8EG 9.8
2026-09-29
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary c…
CVE-2026-103040CRITICALCVSS 9.8EG 9.8
2026-09-29
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowin…

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →