#cwe-502

共收录 943 条相关情报。

漏洞预警2026-09-01 发布INFO

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61750

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

安全公告2026-09-01 发布INFO

ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading

CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution throug

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-502

漏洞预警2026-09-01 发布INFO

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denie...

CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-502 #cwe-915

安全公告2026-09-01 发布INFO

jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types

CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used wi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-502 #cwe-915

安全公告2026-08-31 发布INFO

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-502 #severity:critical

安全公告2026-08-31 发布INFO

Unrestricted deserialization of untrusted data in the cursor pagination component in the...

CVE-2026-83497

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-502 #severity:high

漏洞预警2026-08-31 发布INFO

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-31 发布INFO

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissi...

CVE-2026-83497

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-30 发布INFO

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by trigger...

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

安全公告2026-08-30 发布INFO

Unsafe deserialization of decrypted terms enables node DoS in AshCloak

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-502

安全公告2026-08-29 发布INFO

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being...

CVE-2026-76547

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when impor

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-502 #severity:medium

漏洞预警2026-08-29 发布INFO

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users ...

CVE-2026-76547

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when impor

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFrom...

CVE-2026-55220

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

安全公告2026-08-28 发布INFO

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

CVE-2026-55220

## Summary `Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource()` deserializes the `*__hot

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-502 #severity:critical

漏洞预警2026-08-28 发布INFO

Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.

CVE-2026-81757

Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables e...

CVE-2026-82259

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experim

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

CVE-2026-82222

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue af

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

安全公告2026-08-28 发布INFO

SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

CVE-2026-82259

SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experim

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-502

漏洞预警2026-08-28 发布INFO

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.

CVE-2026-78032

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

漏洞预警2026-08-28 发布INFO

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises use

历史摘要 · 未重新核验 · NVD

#cve #cwe-502