CWE-502

Deserialization of Untrusted Data

BaseDraftLikelihood: Medium

Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Hierarchy (View 1000)

Parents

CWE-913

Children

none

Related attack patterns (CAPEC)

CAPEC-586

CVEs mapped to this weakness (3,323)

page 63 of 167

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-33942	Saloon Saloon	Cri	0.57	9.8	0.01	Mar 26, 2026	Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can…
CVE-2026-32513	WordPress JS Archive List	Hig	0.57	8.8	0.01	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.
CVE-2026-27045	WordPress WooCommerce Infinite Scroll	Hig	0.57	8.8	0.01	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
CVE-2026-25400	WordPress apicona	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
CVE-2026-25360	WordPress Vex	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
CVE-2026-25359	WordPress Pendulum	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
CVE-2026-25358	WordPress Meloo	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
CVE-2026-24981	WordPress Visionary Core	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
CVE-2026-24978	WordPress Jobica Core	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
CVE-2026-24976	WordPress Organici Library	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
CVE-2026-24974	WordPress noo-citilights	Hig	0.57	8.8	0.00	Mar 25, 2026	Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
CVE-2026-25445	WordPress Wishlist Member X	Hig	0.57	8.8	0.01	Mar 19, 2026	Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.
CVE-2026-32355	WordPress Jetengine	Hig	0.57	8.8	0.01	Mar 13, 2026	Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
CVE-2026-3060	Lmsys Sglang	Cri	0.57	9.8	0.01	Mar 12, 2026	SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
CVE-2026-3059	Lmsys Sglang	Cri	0.57	9.8	0.01	Mar 12, 2026	SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
CVE-2026-26114	Microsoft Office SharePoint	Hig	0.57	8.8	0.02	Mar 10, 2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-2599	WordPress Database For Contact Form 7\, Wpforms\, Elementor Forms	Cri	0.57	9.8	0.01	Mar 5, 2026	The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated…
CVE-2026-27379	Nextscripts NextScripts social-networks-auto-poster-facebook-twitter-g	Hig	0.57	8.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
CVE-2026-27338	WordPress Car Zone	Hig	0.57	8.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
CVE-2026-23798	WordPress PowerPress Podcasting plugin	Hig	0.57	8.8	0.01	Mar 5, 2026	Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.

CVE-2026-33942CriMar 26, 2026
Saloon
Saloon
risk 0.57cvss 9.8epss 0.01
Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can…
CVE-2026-32513HigMar 25, 2026
WordPress
JS Archive List
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.
CVE-2026-27045HigMar 25, 2026
WordPress
WooCommerce Infinite Scroll
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
CVE-2026-25400HigMar 25, 2026
WordPress
apicona
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
CVE-2026-25360HigMar 25, 2026
WordPress
Vex
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
CVE-2026-25359HigMar 25, 2026
WordPress
Pendulum
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
CVE-2026-25358HigMar 25, 2026
WordPress
Meloo
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
CVE-2026-24981HigMar 25, 2026
WordPress
Visionary Core
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
CVE-2026-24978HigMar 25, 2026
WordPress
Jobica Core
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
CVE-2026-24976HigMar 25, 2026
WordPress
Organici Library
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
CVE-2026-24974HigMar 25, 2026
WordPress
noo-citilights
risk 0.57cvss 8.8epss 0.00
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
CVE-2026-25445HigMar 19, 2026
WordPress
Wishlist Member X
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.
CVE-2026-32355HigMar 13, 2026
WordPress
Jetengine
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
CVE-2026-3060CriMar 12, 2026
Lmsys
Sglang
risk 0.57cvss 9.8epss 0.01
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
CVE-2026-3059CriMar 12, 2026
Lmsys
Sglang
risk 0.57cvss 9.8epss 0.01
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
CVE-2026-26114HigMar 10, 2026
Microsoft
Office SharePoint
risk 0.57cvss 8.8epss 0.02
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-2599CriMar 5, 2026
WordPress
Database For Contact Form 7\, Wpforms\, Elementor Forms
risk 0.57cvss 9.8epss 0.01
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated…
CVE-2026-27379HigMar 5, 2026
Nextscripts
NextScripts social-networks-auto-poster-facebook-twitter-g
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
CVE-2026-27338HigMar 5, 2026
WordPress
Car Zone
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
CVE-2026-23798HigMar 5, 2026
WordPress
PowerPress Podcasting plugin
risk 0.57cvss 8.8epss 0.01
Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.