CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2026-27414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T12:17:00Z",
    "severity": "HIGH"
  },
  "details": "Contributor PHP Object Injection in Werkstatt \u003c= 4.8.3 versions.",
  "id": "GHSA-3236-q4rc-wfw4",
  "modified": "2026-07-02T12:31:00Z",
  "published": "2026-07-02T12:31:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27414"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-8-3-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-82925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T07:17:03Z",
    "severity": "HIGH"
  },
  "details": "The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site\u0027s WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0\u0027s own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.",
  "id": "GHSA-3237-mv84-xmm9",
  "modified": "2026-09-10T15:33:12Z",
  "published": "2026-09-10T09:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82925"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/bce47707-b60c-42a7-8817-89b1483f41a3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:yaml-axis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-2179"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-16T23:00:17Z",
    "nvd_published_at": "2020-04-16T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a multi-configuration (Matrix) job, or control the contents of a previously configured job\u2019s SCM repository.\n\nYaml Axis Plugin 0.2.1 configures its YAML parser to only instantiate safe types.",
  "id": "GHSA-324h-2v7h-q3xx",
  "modified": "2023-12-22T13:54:14Z",
  "published": "2022-05-24T17:15:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/yaml-axis-plugin/commit/346802860c68a5a9bb4996c81fed4e05bee594f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/yaml-axis-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1825"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/04/16/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RCE vulnerability in Jenkins Yaml Axis Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-18580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-26T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.",
  "id": "GHSA-32f2-chgf-rf94",
  "modified": "2024-04-04T02:40:58Z",
  "published": "2022-05-24T17:02:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18580"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/security/en-us/details/538977/DSA-2019-176-Dell-EMC-Storage-Monitoring-and-Reporting-SMR-Java-RMI-Deserialization-of-Untruste"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-01T16:16:31Z",
    "severity": "CRITICAL"
  },
  "details": "Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.",
  "id": "GHSA-32hx-8wcv-5q49",
  "modified": "2026-05-01T21:31:19Z",
  "published": "2026-05-01T18:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42473"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mix-php/mix"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mix-php/mix/blob/v2.2.17/src/sync-invoke/src/Server.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-34274"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-21T20:15:08Z",
    "severity": "LOW"
  },
  "details": "OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialized data, which can be used to execute arbitrary code on the system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-32mg-q3wg-529p",
  "modified": "2024-07-03T18:43:03Z",
  "published": "2024-05-21T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34274"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenBD/openbd-core/issues/89"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.114"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.115"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T19:17:11Z",
    "nvd_published_at": "2026-04-08T21:17:01Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\nThe `AgentService.loadAgentFromFile` method uses the `js-yaml` library to parse YAML files without disabling dangerous tags (such as `!!js/function` and `!!js/undefined`). This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can exploit this vulnerability by uploading a malicious agent definition file via the API endpoint, leading to remote code execution (RCE) on the server.\n\n## Details\nThe vulnerability exists in the YAML deserialization process. The `js-yaml` library\u0027s `load` function is used without specifying a safe schema (e.g., `JSON_SCHEMA` or `DEFAULT_SAFE_SCHEMA`). This enables the parsing of JavaScript functions and other dangerous types. When a malicious YAML file containing a `!!js/function` tag is parsed, the function is evaluated, leading to arbitrary code execution.\n\nThe vulnerable code is located in `src/agents/agent.service.ts` at line 55.\n\n## PoC\nAn attacker can create a malicious agent YAML file with the following content:\n```yaml\n!!js/function \u003e\n  function(){ require(\u0027child_process\u0027).execSync(\u0027touch /tmp/pwned\u0027) }\n```\nThen, upload this file as an agent definition via the API endpoint that uses `AgentService.loadAgentFromFile`. When the agent is loaded (either during startup or via an API call that triggers loading), the payload will execute the command `touch /tmp/pwned`, demonstrating arbitrary code execution.\n\n## Impact\nThis vulnerability allows an unauthenticated attacker (if the API endpoint is unprotected) or an authenticated attacker with the ability to upload agent definitions to execute arbitrary code on the server. This can lead to complete compromise of the server, data theft, or further network penetration.\n\n## Recommended Fix\nReplace the unsafe `load` method with a safe alternative. Specifically, use the `load` method with a safe schema, such as `JSON_SCHEMA` or `DEFAULT_SAFE_SCHEMA`. For example:\n\n```typescript\nimport yaml from \u0027js-yaml\u0027;\nimport { JSON_SCHEMA } from \u0027js-yaml\u0027;\n\n// In the loadAgentFromFile method\nconst agent = yaml.load(fileContent, { schema: JSON_SCHEMA });\n```\n\nAlternatively, if the application requires only a subset of YAML features, consider using the `safeLoad` method from an older version (though note it was deprecated). The key is to avoid loading tags that can execute code.\n\nAdditionally, validate and sanitize all user input, especially file uploads. Ensure that agent definition files are only uploaded by trusted users and consider storing them in a secure location with proper access controls.",
  "id": "GHSA-32vr-5gcf-3pw2",
  "modified": "2026-04-09T14:29:45Z",
  "published": "2026-04-08T19:17:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-32vr-5gcf-3pw2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39890"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.115"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "nukeviet/nukeviet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.04"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-7725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-07T22:08:23Z",
    "nvd_published_at": "2020-12-31T05:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP\u0027s serialization format when JSON can be used to eliminate the risk).",
  "id": "GHSA-32wr-8wxm-852c",
  "modified": "2021-04-07T22:08:23Z",
  "published": "2021-06-22T15:24:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7725"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nukeviet/nukeviet/pull/2740/commits/05dfb9b4531f12944fe39556f58449b9a56241be"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in NukeViet"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-71365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T20:04:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nPicklescan uses numpy.f2py.crackfortran.myeval, which is a function in numpy to execute remote pickle files.\n\n### Details\nThe attack payload executes in the following steps:\n\n- First, the attacker crafts the payload by calling the numpy.f2py.crackfortran.myeval function in its reduce method\n- Then, when the victim checks whether the pickle file is safe by using the Picklescan library and this library doesn\u0027t detect any dangerous functions, they decide to use pickle.load() on this malicious pickle file, thus leading to remote code execution.\n\n### PoC\n```\nclass RCE:\n    def __reduce__(self):\n        from numpy.f2py.crackfortran import myeval\n        return (myeval, (\"os.system(\u0027ls\u0027)\",))\n```\n\n\n### Impact\nAny organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models.\nAttackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded.\nAttackers can distribute infected pickle files across ML models, APIs, or saved Python objects.\n\n### Report by\nPinji Chen (cpj24@mails.tsinghua.edu.cn) from the NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University, Guanheng Liu (coolwind326@gmail.com).",
  "id": "GHSA-3329-ghmp-jmv5",
  "modified": "2026-09-23T18:15:41Z",
  "published": "2025-12-29T20:04:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3329-ghmp-jmv5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71365"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-myeval-detection-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval"
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-15514"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-01T01:29:00Z",
    "severity": "HIGH"
  },
  "details": "HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\\\.\\pipe\\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the \"docker-users\" group (who may not otherwise have administrator access) to escalate to administrator privileges.",
  "id": "GHSA-332v-39cw-qwg2",
  "modified": "2022-05-14T02:00:53Z",
  "published": "2022-05-14T02:00:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15514"
    },
    {
      "type": "WEB",
      "url": "https://docs.docker.com/docker-for-windows/edge-release-notes"
    },
    {
      "type": "WEB",
      "url": "https://docs.docker.com/docker-for-windows/release-notes"
    },
    {
      "type": "WEB",
      "url": "https://srcincite.io/blog/2018/08/31/you-cant-contain-me-analyzing-and-exploiting-an-elevation-of-privilege-in-docker-for-windows.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105202"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}