CWE-502— Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.— MITRE CWE catalog

3,714 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-502page 64 of 75

CVE-2026-102392HIGHCVSS 7.2EG 7.2
2026-09-30
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
CVE-2026-97256HIGHCVSS 7.2EG 7.2
2026-09-30
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
CVE-2026-103441HIGHCVSS 7.2EG 7.2
2026-09-30
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
CVE-2026-96833HIGHCVSS 7.2EG 7.2
2026-09-30
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
CVE-2026-96832HIGHCVSS 7.2EG 7.2
2026-09-30
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
CVE-2026-96344HIGHCVSS 7.2EG 7.2
2026-09-30
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
CVE-2026-96343HIGHCVSS 7.2EG 7.2
2026-09-30
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
CVE-2026-94677HIGHCVSS 7.2EG 7.2
2026-09-30
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
CVE-2026-94122HIGHCVSS 7.2EG 7.2
2026-09-30
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
CVE-2026-93771HIGHCVSS 7.2EG 7.2
2026-09-30
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
CVE-2026-93651HIGHCVSS 7.2EG 7.2
2026-09-30
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
CVE-2026-93624HIGHCVSS 7.2EG 7.2
2026-09-30
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
CVE-2026-13046HIGHCVSS 7.2EG 7.2
2026-09-29
A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in…
CVE-2026-84862HIGHCVSS 7.2EG 7.2
2026-09-25
IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.
CVE-2026-95603HIGHCVSS 7.2EG 7.2
2026-09-23
Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
CVE-2026-73699HIGHCVSS 7.2EG 7.2
2026-09-10
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional…
CVE-2026-81757HIGHCVSS 7.2EG 7.2
2026-08-28
Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.
CVE-2026-14558HIGHCVSS 7.2EG 7.2
2026-08-28
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject …
CVE-2026-78276HIGHCVSS 7.2EG 7.2
2026-08-27
Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-66620HIGHCVSS 7.2EG 7.2
2026-08-18
Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
CVE-2026-66256HIGHCVSS 7.2EG 7.2
2026-08-13
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger …
CVE-2026-27380HIGHCVSS 7.2EG 7.2
2026-08-13
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
CVE-2026-65549HIGHCVSS 7.2EG 7.2
2026-08-06
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
CVE-2026-65497HIGHCVSS 7.2EG 7.2
2026-07-23
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
CVE-2026-59521HIGHCVSS 7.2EG 7.2
2026-07-13
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.
CVE-2026-10748HIGHCVSS 7.2EG 7.2
2026-06-16
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
CVE-2026-39471HIGHCVSS 7.2EG 7.2
2026-06-15
Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
CVE-2026-39472HIGHCVSS 7.2EG 7.2
2026-06-15
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
CVE-2026-39481HIGHCVSS 7.2EG 7.2
2026-06-15
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
CVE-2026-39498HIGHCVSS 7.2EG 7.2
2026-06-15
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
CVE-2026-39499HIGHCVSS 7.2EG 7.2
2026-06-15
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
CVE-2026-39434HIGHCVSS 7.2EG 7.2
2026-06-15
Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
CVE-2025-27511HIGHCVSS 7.2EG 7.2
2026-06-11
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url lea…
CVE-2026-8135HIGHCVSS 7.2EG 7.2
2026-05-21
Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller. An rogue administrator with privileges to add blocks to an area can bypass the inten…
CVE-2026-39467HIGHCVSS 7.2EG 7.2
2026-04-21
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.
CVE-2026-25917HIGHCVSS 7.2EG 7.2
2026-04-18
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. U…
CVE-2026-3017HIGHCVSS 7.2EG 7.2
2026-04-14
The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import…
CVE-2026-29782HIGHCVSS 7.2EG 7.2
2026-04-02
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from t…
CVE-2026-33725HIGHCVSS 7.2EG 7.2
2026-03-27
Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve…
CVE-2026-3328HIGHCVSS 7.2EG 7.2
2026-03-26
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's …
CVE-2026-22480HIGHCVSS 7.2EG 7.2
2026-03-25
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
CVE-2026-29109HIGHCVSS 7.2EG 7.2
2026-03-20
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component tha…
CVE-2026-28277HIGHCVSS 7.2EG 7.2
2026-03-05
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstru…
CVE-2026-3452HIGHCVSS 7.2EG 7.2
2026-03-04
Concrete CMS below version 9.4.8 is vulnerable to Remote Code Execution by stored PHP object injection into the Express Entry List block via the columns parameter. An authenticated administrator can store attacker-controlled serialized…
CVE-2024-47886HIGHCVSS 7.2EG 7.2
2026-03-02
Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtua…
CVE-2026-28138HIGHCVSS 7.2EG 7.2
2026-02-26
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
CVE-2026-25316HIGHCVSS 7.2EG 7.2
2026-02-19
Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.
CVE-2026-22333HIGHCVSS 7.2EG 7.2
2026-02-19
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.
CVE-2026-25615HIGHCVSS 7.2EG 7.2
2026-02-03
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.
CVE-2025-15438HIGHCVSS 7.2EG 7.2
2026-01-02
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to…

Map vulnerabilities like CWE-502 to your infrastructure

EchelonGraph correlates every CVE — across CWE-502 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →