By weakness (CWE)

CWE-502: related vulnerabilities

CVEs classified under CWE-502. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

115 published vulnerabilities · page 2 of 2

• CVE-2025-27511HIGH 7.2

  GeoServer, a widely-used open-source geospatial data platform, contains a vulnerability in its DB2 DataStore Extension that allows authenticated administrators to execute arbitrary code on the server through a malicious database connection string. An attacker with admin credentials can craft a specially crafted DB2 JDBC URL that exploits JNDI (Java Naming and Directory Interface) injection to achieve remote code execution. The vulnerability was patched in version 2.27.0.

• CVE-2026-39472HIGH 7.2

  A PHP object injection vulnerability exists in WooCommerce PDF Invoices & Packing Slips plugin versions before 5.9.0. An authenticated shop manager can exploit this flaw to execute arbitrary code on the affected WordPress site, potentially compromising the entire installation. The vulnerability requires elevated privileges to trigger, but once exploited, grants complete control over the server and sensitive data.

• CVE-2026-39499HIGH 7.2

  A PHP object injection vulnerability exists in the Advanced Product Fields (Product Addons) plugin for WooCommerce versions 1.6.19 and earlier. Shop managers—authenticated users with elevated privileges—can inject malicious PHP objects that execute arbitrary code on the server. The vulnerability requires an authenticated attacker with shop manager or higher role, so it does not pose an immediate risk to unauthenticated visitors, but it represents a significant lateral-movement or privilege-escalation vector for compromised or malicious insiders.

• CVE-2026-55153HIGH 7.1

  mchange-commons-java, a widely-used Java utility library, contains a critical flaw in how it handles JNDI object construction. Before version 0.6.0, the library's ObjectFactory can be tricked into creating and configuring arbitrary Java objects. An attacker who can control serialized data reaching your application can exploit this to trigger unsafe initialization sequences—for instance, making a Swing component fetch content from a malicious URL. This is particularly dangerous because the attack often occurs within the trusted security context of your application.

• CVE-2026-48775MEDIUM 6.8

  LangGraph SQLite Checkpoint, a data persistence component in LangGraph, can deserialize untrusted Python objects from checkpoint files stored in SQLite databases. If an attacker gains write access to the checkpoint storage backend, they can inject malicious serialized objects that execute arbitrary code when the application loads a checkpoint. This is a defense-in-depth vulnerability—it requires an attacker to first compromise the underlying storage layer, but if they do, they can escalate that access to runtime code execution. The issue affects versions 4.1.0 and earlier; version 4.1.1 and later contain a fix.

• CVE-2026-53914MEDIUM 6.7

  JetBrains Kotlin versions before 2.4.20 contain a code execution vulnerability in how the build cache system handles metadata. When Kotlin processes build cache data, it deserializes untrusted information without proper validation, allowing an attacker with high privilege access to the build system to execute arbitrary code. This is not a trivial attack—it requires administrative or high-privileged access to the local machine or build environment—but the impact is severe.

• CVE-2026-12115MEDIUM 6.6

  The Counter Box plugin for WordPress contains a vulnerability that allows administrator-level users to inject malicious PHP objects into the system through its import feature. The vulnerability exists in how the plugin processes imported data without properly validating it first. However, the injected objects themselves cannot cause direct harm unless other plugins or themes on the same WordPress site contain specific vulnerable code patterns (called POP chains) that could be chained together with this vulnerability. The injection occurs automatically when importing data or editing imported items, with no extra steps required from the attacker.

• CVE-2026-7566MEDIUM 6.6

  The LearnPress – Backup & Migration Tool WordPress plugin contains a PHP Object Injection flaw that allows authenticated administrators to inject malicious serialized objects into the application. By itself, this vulnerability is limited in impact because the plugin does not include a known Property-Oriented Programming (POP) chain. However, if your WordPress installation also runs other vulnerable plugins or themes that contain POP chains, an administrator could potentially weaponize this vulnerability to delete files, steal sensitive data, or execute arbitrary code on your server.

• CVE-2026-56304MEDIUM 6.5

  Picklescan, a Python security tool, has a vulnerability in versions before 1.0.1 that allows attackers to craft malicious pickle payloads to create arbitrary zero-byte files on affected systems without authentication. While the vulnerability cannot directly execute code, it can be weaponized to create lock files or filesystem artifacts that disrupt application functionality. This attack is possible because the tool doesn't properly validate pickle data before deserializing it, a known dangerous practice in Python. An attacker only needs network access to send a crafted pickle payload to an application using a vulnerable version of picklescan.

• CVE-2026-34993MEDIUM 6.4

  AIOHTTP, a popular Python framework for asynchronous HTTP operations, contains a vulnerability in its CookieJar.load() function that could allow code execution when loading untrusted cookie data. The vulnerability exists in versions before 3.14.0. While the risk is moderate, it primarily affects applications that explicitly load cookie files from untrusted sources—a less common pattern than using CookieJar with application-generated data. Upgrading to version 3.14.0 or later eliminates the risk.

• CVE-2026-12787MEDIUM 6.3

  A remote code execution vulnerability exists in zhilink's ADP Application Developer Platform version 1.0.0. An authenticated attacker can exploit a flaw in the testConnection endpoint by manipulating the jdbcUrl parameter to trigger unsafe deserialization, potentially allowing arbitrary code execution on the affected system. The vulnerability has already been disclosed publicly, and the vendor has not responded to disclosure attempts.

• CVE-2026-48560MEDIUM 5.4

  Microsoft Office SharePoint contains a deserialization flaw that allows an authenticated user to manipulate data in transit, potentially impersonating other users or altering information within the SharePoint environment. The vulnerability requires valid credentials to exploit, limiting exposure to insider threats or compromised accounts rather than unauthenticated internet attackers. The impact is confined to confidentiality and integrity concerns—no system availability is at risk.

• CVE-2026-10566MEDIUM 5.3

  A vulnerability exists in FoundationAgents MetaGPT versions up to 0.8.2 that allows local attackers with user-level privileges to trigger unsafe deserialization through manipulation of function arguments in the Message.check_instruct_content handler. An attacker with local access and basic user permissions can exploit this to potentially read, modify, or disrupt system operations. Public exploit code is available, increasing near-term risk for organizations running affected versions.

• CVE-2026-14723MEDIUM 5.3

  AD-Security's AD_Miner version 1.9.0 contains a flaw in its cache analysis component that allows a local user with basic system access to execute arbitrary code by manipulating how the tool processes cached data. An attacker would need to already have a user account on the system to exploit this; remote attacks are not possible. The vulnerability stems from unsafe handling of serialized data without proper validation.

• CVE-2026-50589MEDIUM 5.3

  OpenStack Ironic versions 32 through 36 contain a vulnerability that allows unauthenticated attackers to crash the service by sending specially crafted JSON payloads to certain API and JSON-RPC endpoints. An attacker requires only network access to the affected service and no credentials—they can disrupt availability without gaining deeper system access. The vulnerability was patched in version 37.0.0.