← Back
CWE-502

3,539 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

JSON object

Loading...

CVEs (3,539)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-62077
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
CVE-2026-62076
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
CVE-2026-62054
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-62021
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
CVE-2026-42723
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2026-42719
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
CVE-2026-42718
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
CVE-2026-42716
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVE-2026-62044
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
CVE-2026-104398
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooComme...Show more
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.Show less
CVE-2026-94676
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
7.2 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.
CVE-2026-105885
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
CVE-2026-93945
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
CVE-2026-93944
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
CVE-2026-93943
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
CVE-2026-93942
-
-
Oct 13, 2026
Oct 10, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.