CWE-502

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbe

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askk

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.sprin

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any pac

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An a

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code exec

Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.

Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/

picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config funct

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attacker

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, a

picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entit

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attac

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function thro