CWE-502: Deserialization of untrusted data
3,625 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 76 of them as exploited in the wild.
- Published CVEs
- 3,625
- Last 12 months
- 1,459
- Critical
- 1,393
- Known exploited
- 76
Critical 1,393High 1,753Medium 431Low 47Not scored 1
CVEs per yearBy the year they were published
- 2018105
- 201893
- 2019126
- 202042
- 20204
- 2023188
- 20261,198
- 2026713
- 2026451
- 2026284
- 2026216
- 2026184
Known exploitedNewest addition to KEV first
- CVE-2021-23758
Deserialization of Untrusted Data
AjaxPro.2
ExploitedHigh8.1 - CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8 - CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8 - CVE-2026-45659
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh8.8 - CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Mirasvit · Full Page Cache Warmer for Magento 2
ExploitedCritical9.3 - CVE-2023-21529
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23
ExploitedHigh8.8 - CVE-2026-20131
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedCritical10.0 - CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8
Newest CVEs
- CVE-2026-115731
Report Deserialization Code Execution
Perforce · Puppet Enterprise
Critical9.4 - CVE-2026-115878
Stanza: RCE via pickle deserialization in the lemmatizer
stanfordnlp · stanza
High7.8 - CVE-2026-120833
labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch
NIST · labbench
High8.5 - CVE-2026-102435
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
themefic · Ultra Addons for Contact Form 7
Critical9.8 - CVE-2026-120320
jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization
jxxghp · MoviePilot
Medium5.1 - CVE-2026-118636
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Apache Software Foundation · Apache MINA
Critical9.8 - CVE-2026-109220
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
addonsorg · PDF Invoice for WooCommerce + Drag and Drop Template Builder
Critical9.8 - CVE-2026-63393
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
opensearch-project · sql
High8.7 - CVE-2026-118938
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
trailofbits · fickling
High8.8 - CVE-2026-16760
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
trailofbits · fickling
High8.8