Filtered by CWE-502
Total 2180 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-43208 1 Nextgen 1 Mirth Connect 2025-10-21 9.8 Critical
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
CVE-2023-40044 1 Progress 1 Ws Ftp Server 2025-10-21 10 Critical
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
CVE-2025-49655 1 Keras 1 Keras 2025-10-21 9.8 Critical
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
CVE-2017-20206 1 Wordpress 1 Wordpress 2025-10-21 9.8 Critical
The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
CVE-2025-62515 1 Marsupialtail 1 Quokka 2025-10-21 9.8 Critical
pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data.
CVE-2017-20208 3 Metagauss, Registrationmagic, Wordpress 3 Registrationmagic, Registrationmagic, Wordpress 2025-10-21 9.8 Critical
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
CVE-2017-20207 2 Dan Coulter, Wordpress 2 Flickr Gallery, Wordpress 2025-10-21 9.8 Critical
The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting this vulnerability with the WP_Theme() class to create backdoors.
CVE-2025-47784 1 Emlog 1 Emlog 2025-10-20 9.8 Critical
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.
CVE-2025-11622 1 Ivanti 1 Endpoint Manager 2025-10-20 7.8 High
Insecure deserialization in Ivanti Endpoint Manager allows a local authenticated attacker to escalate their privileges.
CVE-2025-45146 2 Codefuse, Modelcache Project 2 Modelcache, Modelcache 2025-10-17 9.8 Critical
ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability allows attackers to execute arbitrary code via supplying crafted data.
CVE-2025-8963 1 Jeecg 1 Jimureport 2025-10-17 6.3 Medium
A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".
CVE-2023-46615 1 Kallidan 1 Kd Coming Soon 2025-10-17 5.4 Medium
Deserialization of Untrusted Data vulnerability in Kalli Dan. KD Coming Soon.This issue affects KD Coming Soon: from n/a through 1.7.
CVE-2023-49886 1 Ibm 1 Transformation Extender Advanced 2025-10-16 9.8 Critical
IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2025-3413 1 Opplus 1 Springboot-admin 2025-10-16 6.3 Medium
A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-49712 1 Microsoft 3 Sharepoint Enterprise Server 2016, Sharepoint Server, Sharepoint Server 2010 2025-10-15 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53772 1 Microsoft 2 Web Deploy, Web Deploy 4.0 2025-10-15 8.8 High
Deserialization of untrusted data in Web Deploy allows an authorized attacker to execute code over a network.
CVE-2024-9070 1 Bentoml 1 Bentoml 2025-10-15 N/A
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
CVE-2024-9053 1 Vllm-project 1 Vllm 2025-10-15 9.8 Critical
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
CVE-2024-10190 1 Horovod 1 Horovod 2025-10-15 N/A
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
CVE-2024-38024 1 Microsoft 1 Sharepoint Server 2025-10-14 7.2 High
Microsoft SharePoint Server Remote Code Execution Vulnerability