CWE-502: Deserialization of untrusted data
3,636 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 76 of them as exploited in the wild.
- Published CVEs
- 3,636
- Last 12 months
- 1,454
- Critical
- 1,395
- Known exploited
- 76
Critical 1,395High 1,763Medium 431Low 47Not scored 0
CVEs per yearBy the year they were published
- 20153
- 201610
- 201769
- 2018127
- 2019135
- 2020158
- 2021224
- 2022180
- 2023269
- 2024432
- 2025665
- 20261,353
Known exploitedNewest addition to KEV first
- CVE-2021-23758
Deserialization of Untrusted Data
AjaxPro.2
ExploitedHigh8.1 - CVE-2026-63077
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8 - CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8 - CVE-2026-45659
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh8.8 - CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Mirasvit · Full Page Cache Warmer for Magento 2
ExploitedCritical9.3 - CVE-2023-21529
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23
ExploitedHigh8.8 - CVE-2026-20131
Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
ExploitedCritical10.0 - CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedCritical9.8
Newest CVEs
- CVE-2026-124318
Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields
treeio · treeio
High8.6 - CVE-2026-104738
Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters
nasirahmed · Advanced Form Integration — Connect Forms to 300+ Apps
High8.1 - CVE-2026-87112
QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters
quarka · QA Assistants – Driven by data
High8.8 - CVE-2026-104010
WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()
creativewerkdesigns · WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database
High7.5 - CVE-2026-119516
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
Mamunur Rashid · Radius Booking — Booking Calendar for Appointments & Services
Critical9.8 - CVE-2026-120859
PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files
PyMoDAQ · PyMoDAQ
High8.5 - CVE-2026-120499
h5io before 0.2.6 Arbitrary Code Execution via read_hdf5
h5io · h5io
High8.5 - CVE-2026-102739
ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution
francescopace · espectre
High7.8 - CVE-2026-92190
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability
Quest · Foglight for Databases
Critical9.8 - CVE-2026-118627
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
MLflow · MLflow
High7.8