CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2022-40238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-26T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user\u0027s profile. This can lead to code execution on the server when the user\u0027s profile is accessed.",
  "id": "GHSA-9gw9-mrm5-m5x9",
  "modified": "2022-10-28T19:00:33Z",
  "published": "2022-10-26T19:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40238"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-2292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-30T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.",
  "id": "GHSA-9hgj-f7f3-cph7",
  "modified": "2022-05-17T01:17:12Z",
  "published": "2022-05-17T01:17:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2292"
    },
    {
      "type": "WEB",
      "url": "https://puppet.com/security/cve/cve-2017-2292"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201709-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63721"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-08T17:16:20Z",
    "severity": "HIGH"
  },
  "details": "HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component allowing attackers to achieve RCE and take over the server.",
  "id": "GHSA-9hqp-6jv3-9h7w",
  "modified": "2025-12-11T00:30:28Z",
  "published": "2025-12-08T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63721"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/k1ng0fic3/e8c8c9353fff8fa95e2c2952587e9266"
    },
    {
      "type": "WEB",
      "url": "https://github.com/k1ng0fic3/secrisk/blob/main/README.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.juddi:juddi-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-37578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-02T18:16:42Z",
    "nvd_published_at": "2021-07-29T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Apache jUDDI uses several classes related to Java\u0027s Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services.\n\nRMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. \n\nFor both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.",
  "id": "GHSA-9hx8-2mrv-r674",
  "modified": "2021-08-31T21:02:02Z",
  "published": "2021-08-09T20:41:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37578"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/juddi/commit/dd880ffe7694a70cee75efeee79c9197d261866f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/juddi"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r82047b3ba774cf870ea8e1e9ec51c6107f6cd056d4e36608148c6e71%40%3Cprivate.juddi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/07/29/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in Apache jUDDI"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-25358"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T17:16:46Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through \u003c 2.8.2.",
  "id": "GHSA-9j7f-jrv9-w3rr",
  "modified": "2026-03-26T18:31:33Z",
  "published": "2026-03-25T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25358"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/meloo/vulnerability/wordpress-meloo-theme-2-8-2-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T13:20:18Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated PHP Object Injection in Kapee \u003c 1.7.0 versions.",
  "id": "GHSA-9j7w-3h5g-wv28",
  "modified": "2026-06-17T18:35:48Z",
  "published": "2026-06-17T18:35:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39446"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/kapee/vulnerability/wordpress-kapee-theme-1-7-0-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-28072"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-04T16:15:07Z",
    "severity": "HIGH"
  },
  "details": "\nDell Alienware Command Center, versions prior to 5.5.51.0, contain a deserialization of untrusted data vulnerability. A local malicious user could potentially send specially crafted requests to the .NET Remoting server to run arbitrary code on the system.\n\n",
  "id": "GHSA-9j8g-2rc4-666j",
  "modified": "2024-04-04T07:26:17Z",
  "published": "2023-09-04T18:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28072"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-in/000212982/dsa-2023-158"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T09:15:15Z",
    "severity": "MODERATE"
  },
  "details": "Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.",
  "id": "GHSA-9jfw-fmcq-hgjp",
  "modified": "2025-04-01T09:30:20Z",
  "published": "2025-04-01T09:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27130"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN87266215"
    },
    {
      "type": "WEB",
      "url": "https://www.welcart.com/archives/23868.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53874"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T20:45:20Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source.\n\n### Details\n\nIt\u0027s possible to hide the `eval` call nested under another callable via `getattr`.\n\n### PoC\n\n```python\nimport builtins\n\nclass EvilClass:\n    @staticmethod\n    def _obfuscated_eval(payload):\n        getattr(builtins, \"eval\")(payload)\n\n    def __reduce__(self):\n        payload = \"__import__(\u0027os\u0027).system(\u0027echo \\\"successful attack\\\"\u0027)\"\n        return self._obfuscated_eval, (payload,)\n```\n\n\n### Impact\n\nWho is impacted? \nAny organization or individual relying on picklescan to detect malicious pickle files from untrusted sources.\n\nWhat is the impact? \nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\n\nSupply Chain Attack: Attackers can distribute infected pickle files to system that load serialized ML models, APIs, or saved Python objects from untrusted sources.",
  "id": "GHSA-9m3x-qqw2-h32h",
  "modified": "2026-06-18T14:41:54Z",
  "published": "2026-02-02T20:45:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9m3x-qqw2-h32h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53874"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/59"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/173c8f2a869ea9b69b543477525ec70611c3c6f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/releases/tag/v1.0.1"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-obfuscated-eval-call"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "picklescan missing detection by simple obfuscation of a `builtins.eval` call"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@tanstack/start-server-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.167.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T16:37:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nA type-confusion bug in seroval \u2264 1.5.2 ([upstream advisory](https://github.com/lxsmnsyc/seroval/security/advisories)) allowed a crafted JSON body sent to one TanStack Start server function to trigger invocation of a different client-referenced server function as a side effect of deserializing the request payload.\n\nThis is not an authentication bypass and not remote code execution. The mechanism only invokes server functions that the same client could already reach directly via /_serverFn/\u003cid\u003e, and the target function\u0027s full middleware chain \u2014 including any user-supplied authentication, authorization, and inputValidator \u2014 runs as it would on a direct call.\n\n### Impact\nTo be exploitable in any meaningful sense, an application would need to expose a client-referenced server function that:\n\n- [ ] Performs a privileged side effect, and\n- [ ] Has no authentication/authorization middleware, and\n- [ ] Has no input validation\n\nA function meeting all three is already directly callable by any unauthenticated client at its own endpoint, so the practical impact on correctly-written applications is nil. The residual concerns are:\n\nA request to function A could cause function B to also execute, which may surprise observability/audit logging that keys off the request URL.\n\nRequest-level middleware (as opposed to per-function middleware) does not re-run for the inner invocation.\nServer-only functions (isClientReferenced: false) cannot be reached through this mechanism.\n\n### Patches\nUpgrade to @tanstack/start-server-core \u2265 1.167.30 (or the equivalent dated release of @tanstack/react-start / @tanstack/solid-start). The fix bumps seroval to \u2265 1.5.3 and adds defense-in-depth to the serialization adapter plugin shape so adapter payloads cannot be confused with internal seroval node types.\n\n### Workarounds\nIf you cannot upgrade immediately, ensure every createServerFn(...) exposed to the client has both an .inputValidator(...) and authentication/authorization middleware via .middleware([...]). This is recommended regardless of this advisory.\n\n### Credits\n- [Mufeed VH](https://x.com/mufeedvh) of [Winfunc Research](https://winfunc.com/)\n- Upstream fix coordinated with Seroval maintainers https://github.com/lxsmnsyc/seroval",
  "id": "GHSA-9m65-766c-r333",
  "modified": "2026-05-14T16:37:10Z",
  "published": "2026-05-14T16:37:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TanStack/router/security/advisories/GHSA-9m65-766c-r333"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TanStack/router"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxsmnsyc/seroval/security/advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function"
}