CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,104)

page 19 of 156

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-69370	WordPress Capella	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
CVE-2025-69329	WordPress Prestige	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
CVE-2025-69301	WordPress PhotoMe	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
CVE-2025-68541	WordPress Ippsum	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.
CVE-2025-67997	WordPress Travelicious	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
CVE-2025-67996	WordPress Nestin	Cri	0.64	9.8	0.00	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.
CVE-2025-67995	WordPress PatioTime	Cri	0.64	9.8	0.01	Feb 20, 2026	Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.
CVE-2026-23549	WordPress Wpevently	Cri	0.64	9.8	0.00	Feb 19, 2026	Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2026-23542	WordPress Grand Restaurant	Cri	0.64	9.8	0.00	Feb 19, 2026	Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
CVE-2026-26333	Calero VeraSMART	Cri	0.64	9.8	0.01	Feb 13, 2026	Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with…
CVE-2026-26221	Hyland OnBase	Cri	0.64	9.8	0.01	Feb 13, 2026	Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g.,…
CVE-2025-69872	Grantjenks Python Diskcache	Cri	0.64	9.8	0.01	Feb 11, 2026	DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2026-21531	Microsoft Azure Conversation Authoring Client Library	Cri	0.64	9.8	0.02	Feb 10, 2026	Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
CVE-2020-37071	Craftcms vCard Plugin	Cri	0.64	9.8	0.01	Feb 3, 2026	CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the…
CVE-2026-0773	Upsonic Upsonic	Cri	0.64	9.8	0.01	Jan 23, 2026	Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw…
CVE-2026-0764	Binary Husky Gpt Academic	Cri	0.64	9.8	0.01	Jan 23, 2026	GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific…
CVE-2026-0763	Binary Husky Gpt Academic	Cri	0.64	9.8	0.01	Jan 23, 2026	GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this…
CVE-2026-0760	Foundation Agents MetaGPT	Cri	0.64	9.8	0.01	Jan 23, 2026	Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to…
CVE-2025-69079	WordPress Sound \| Musical Instruments Online Store	Cri	0.64	9.8	0.00	Jan 22, 2026	Deserialization of Untrusted Data vulnerability in ThemeREX Sound \| Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound \| Musical Instruments Online Store: from n/a through <= 1.6.9.
CVE-2025-67617	WordPress Consult Aid	Cri	0.64	9.8	0.01	Jan 22, 2026	Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

CVE-2025-69370CriFeb 20, 2026
WordPress
Capella
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
CVE-2025-69329CriFeb 20, 2026
WordPress
Prestige
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.
CVE-2025-69301CriFeb 20, 2026
WordPress
PhotoMe
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
CVE-2025-68541CriFeb 20, 2026
WordPress
Ippsum
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.
CVE-2025-67997CriFeb 20, 2026
WordPress
Travelicious
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
CVE-2025-67996CriFeb 20, 2026
WordPress
Nestin
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.
CVE-2025-67995CriFeb 20, 2026
WordPress
PatioTime
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.
CVE-2026-23549CriFeb 19, 2026
WordPress
Wpevently
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.1.1.
CVE-2026-23542CriFeb 19, 2026
WordPress
Grand Restaurant
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
CVE-2026-26333CriFeb 13, 2026
Calero
VeraSMART
risk 0.64cvss 9.8epss 0.01
Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs (including EndeavorServer.rem and RemoteFileReceiver.rem) and permits the use of SOAP and binary formatters with…
CVE-2026-26221CriFeb 13, 2026
Hyland
OnBase
risk 0.64cvss 9.8epss 0.01
Hyland OnBase contains an unauthenticated .NET Remoting exposure in the OnBase Workflow Timer Service (Hyland.Core.Workflow.NTService.exe). An attacker who can reach the service can send crafted .NET Remoting requests to default HTTP channel endpoints on TCP/8900 (e.g.,…
CVE-2025-69872CriFeb 11, 2026
Grantjenks
Python Diskcache
risk 0.64cvss 9.8epss 0.01
DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.
CVE-2026-21531CriFeb 10, 2026
Microsoft
Azure Conversation Authoring Client Library
risk 0.64cvss 9.8epss 0.02
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
CVE-2020-37071CriFeb 3, 2026
Craftcms
vCard Plugin
risk 0.64cvss 9.8epss 0.01
CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the…
CVE-2026-0773CriJan 23, 2026
Upsonic
Upsonic
risk 0.64cvss 9.8epss 0.01
Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw…
CVE-2026-0764CriJan 23, 2026
Binary Husky
Gpt Academic
risk 0.64cvss 9.8epss 0.01
GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability. The specific…
CVE-2026-0763CriJan 23, 2026
Binary Husky
Gpt Academic
risk 0.64cvss 9.8epss 0.01
GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this…
CVE-2026-0760CriJan 23, 2026
Foundation Agents
MetaGPT
risk 0.64cvss 9.8epss 0.01
Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to…
CVE-2025-69079CriJan 22, 2026
WordPress
Sound | Musical Instruments Online Store
risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
CVE-2025-67617CriJan 22, 2026
WordPress
Consult Aid
risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.