CWE-502

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ve

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entir

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that

Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrusted Data vulnerabili

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the Transition

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.c

my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.1

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 all

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP ob

When adding a key to a remote agent constraint extensions such as [email protected] were not serializ

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Jav

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that d

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands

NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqledit

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2

Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Them

Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This is

Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection

Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issu

Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issu

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issu

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects

Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects An

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affec

Deserialization of Untrusted Data vulnerability in strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injecti

Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.T

Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `wei

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13