CWE-502 · Deserialization and Object Injection
Deserialization of Untrusted Data
3,542CVEs
70exploited
52with a public check
250likely (EPSS 10%+)
SortMost likely exploited
3,542 CVEs with CWE-502 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-53770In CISA KEVExploitedMicrosoft SharePoint Server - Remote Code Execution (ToolShell)Microsoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 9.8 · 2025-07-20 | 9.8 | 100% | 2025-07-20 |
| CVE-2023-0669In CISA KEVExploitedFortra GoAnywhere MFT - Remote Code ExecutionFortra · Goanywhere MFT · CVSS 7.2 · 2023-02-06 | 7.2 | 100% | 2023-02-06 |
| CVE-2021-44228In CISA KEVExploitedApache Log4j2 Remote Code InjectionApache Software Foundation · Apache Log4j2 · CVSS 10 · 2021-12-10 | 10.0 | 100% | 2021-12-10 |
| CVE-2021-35464In CISA KEVExploitedForgeRock OpenAM <7.0 - Remote Code ExecutionForgeRock · Access Management (AM) · CVSS 9.8 · 2021-07-22 | 9.8 | 100% | 2021-07-22 |
| CVE-2023-46604In CISA KEVExploitedApache ActiveMQ - Remote Code ExecutionApache Software Foundation · Apache ActiveMQ · CVSS 10 · 2023-10-27 | 10.0 | 100% | 2023-10-27 |
| CVE-2023-29300In CISA KEVExploitedAdobe ColdFusion - Pre-Auth Remote Code ExecutionAdobe · ColdFusion · CVSS 9.8 · 2023-07-12 | 9.8 | 100% | 2023-07-12 |
| CVE-2025-59287In CISA KEVExploitedWindows Server Update Service - Insecure DeserializationMicrosoft · Windows Server 2012 · CVSS 9.8 · 2025-10-14 | 9.8 | 100% | 2025-10-14 |
| CVE-2022-41082In CISA KEVExploitedMicrosoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23 · CVSS 8 · 2022-10-03 | 8.0 | 100% | 2022-10-03 |
| CVE-2022-47986In CISA KEVExploitedIBM Aspera Faspex <=4.4.2 PL1 - Remote Code ExecutionIBM · Aspera Faspex · CVSS 9.8 · 2023-02-17 | 9.8 | 100% | 2023-02-17 |
| CVE-2018-2628In CISA KEVExploitedOracle WebLogic Server Deserialization - Remote Code ExecutionOracle Corporation · WebLogic Server · CVSS 9.8 · 2018-04-19 | 9.8 | 100% | 2018-04-19 |
| CVE-2020-10189In CISA KEVExploitedManageEngine Desktop Central Java DeserializationZoho · ManageEngine · CVSS 9.8 · 2020-03-06 | 9.8 | 100% | 2020-03-06 |
| CVE-2020-7961In CISA KEVExploitedLiferay Portal Unauthenticated < 7.2.1 CE GA2 - Remote Code ExecutionLiferay · Liferay Portal · CVSS 9.8 · 2020-03-20 | 9.8 | 100% | 2020-03-20 |
| CVE-2022-35405In CISA KEVExploitedZoho ManageEngine - Remote Code ExecutionZoho · ManageEngine · CVSS 9.8 · 2022-07-19 | 9.8 | 100% | 2022-07-19 |
| CVE-2019-18935In CISA KEVExploitedProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys…Progress · Telerik UI for ASP.NET AJAX · CVSS 9.8 · 2019-12-11 | 9.8 | 100% | 2019-12-11 |
| CVE-2025-55182In CISA KEVExploitedReact Server Components - Remote Code ExecutionMeta · react-server-dom-webpack · CVSS 10 · 2025-12-03 | 10.0 | 100% | 2025-12-03 |
| CVE-2017-1000353In CISA KEVExploitedJenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerabil…Jenkins · Jenkins · CVSS 9.8 · 2018-01-29 | 9.8 | 100% | 2018-01-29 |
| CVE-2025-49113In CISA KEVExploitedRoundcube Webmail - Remote Code ExecutionRoundcube · Webmail · CVSS 9.9 · 2025-06-02 | 9.9 | 100% | 2025-06-02 |
| CVE-2017-9805In CISA KEVExploitedApache Struts2 S2-052 - Remote Code ExecutionApache Software Foundation · Apache Struts · CVSS 8.1 · 2017-09-15 | 8.1 | 99% | 2017-09-15 |
| CVE-2020-0618In CISA KEVExploitedMicrosoft SQL Server Reporting Services - Remote Code ExecutionMicrosoft · Microsoft SQL Server · CVSS 9.8 · 2020-02-11 | 9.8 | 99% | 2020-02-11 |
| CVE-2018-1000861In CISA KEVExploitedJenkins - Remote Command InjectionJenkins · Jenkins Stapler Web Framework · CVSS 9.8 · 2018-12-10 | 9.8 | 98% | 2018-12-10 |
| CVE-2015-7450In CISA KEVExploitedIBM WebSphere Java Object Deserialization - Remote Code ExecutionIBM · WebSphere Application Server and Server Hypervisor Edition · CVSS 9.8 · 2016-01-02 | 9.8 | 98% | 2016-01-02 |
| CVE-2021-42237In CISA KEVExploitedSitecore Experience Platform Pre-Auth RCESitecore · XP · CVSS 9.8 · 2021-11-05 | 9.8 | 97% | 2021-11-05 |
| CVE-2025-5086In CISA KEVExploitedDassault Systèmes DELMIA Apriso (up to 2025) - Insecure DeserializationDassault Systèmes · DELMIA Apriso · CVSS 9 · 2025-06-02 | 9.0 | 97% | 2025-06-02 |
| CVE-2020-2555In CISA KEVExploitedVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0,…Oracle Corporation · WebCenter Portal · CVSS 9.8 · 2020-01-15 | 9.8 | 97% | 2020-01-15 |
| CVE-2023-38203In CISA KEVExploitedAdobe ColdFusion - Deserialization of Untrusted DataAdobe · ColdFusion · CVSS 9.8 · 2023-07-20 | 9.8 | 97% | 2023-07-20 |
| CVE-2021-26857In CISA KEVExploitedMicrosoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Microsoft Exchange Server 2010 Service Pack 3 · CVSS 7.8 · 2021-03-02 | 7.8 | 96% | 2021-03-02 |
| CVE-2019-10068In CISA KEVExploitedKentico CMS Insecure Deserialization Remote Code ExecutionKentico · Xperience · CVSS 9.8 · 2019-03-26 | 9.8 | 95% | 2019-03-26 |
| CVE-2015-4852In CISA KEVExploitedThe WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java…Oracle · WebLogic Server · CVSS 9.8 · 2015-11-18 | 9.8 | 95% | 2015-11-18 |
| CVE-2026-63077In CISA KEVExploitedJetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code ExecutionJetBrains · TeamCity · CVSS 9.8 · 2026-07-27 | 9.8 | 95% | 2026-07-27 |
| CVE-2025-24016In CISA KEVExploitedWazuh - Unsafe Deserialization Remote Code Executionwazuh · wazuh · CVSS 9.9 · 2025-02-10 | 9.9 | 94% | 2025-02-10 |
| CVE-2019-6340In CISA KEVExploitedDrupal - Remote Code ExecutionDrupal · Drupal Core · CVSS 8.1 · 2019-02-21 | 8.1 | 92% | 2019-02-21 |
| CVE-2017-12149In CISA KEVExploitedJboss Application Server - Remote Code ExecutionRed Hat, Inc. · jbossas · CVSS 9.8 · 2017-10-04 | 9.8 | 91% | 2017-10-04 |
| CVE-2017-3066In CISA KEVExploitedAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeD…Adobe · Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11… · CVSS 9.8 · 2017-04-27 | 9.8 | 91% | 2017-04-27 |
| CVE-2025-26399In CISA KEVExploitedSolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCESolarWinds · Web Help Desk · CVSS 9.8 · 2025-09-23 | 9.8 | 91% | 2025-09-23 |
| CVE-2024-40711In CISA KEVExploitedVeeam Backup & Replication - UnauthenticatedVeeam · Backup and Recovery · CVSS 9.8 · 2024-09-07 | 9.8 | 90% | 2024-09-07 |
| CVE-2023-40044In CISA KEVExploitedWS_FTP Server - Insecure DeserializationProgress Software Corporation · WS_FTP Server · CVSS 10 · 2023-09-27 | 10.0 | 90% | 2023-09-27 |
| CVE-2024-28986In CISA KEVExploitedSolarWinds Web Help Desk < 12.8.3 - Insecure DeserializationSolarWinds · Web Help Desk · CVSS 9.8 · 2024-08-13 | 9.8 | 85% | 2024-08-13 |
| CVE-2025-40551In CISA KEVExploitedSolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCESolarWinds · Web Help Desk · CVSS 9.8 · 2026-01-28 | 9.8 | 84% | 2026-01-28 |
| CVE-2019-9874In CISA KEVExploitedSitecore Experience Platform - Deserialization of Untrusted DataSitecore · CMS and Experience Platform (XP) · CVSS 9.8 · 2019-05-31 | 9.8 | 84% | 2019-05-31 |
| CVE-2021-23758In CISA KEVExploitedDeserialization of Untrusted DataAjax.NET Professional · AjaxPro.2 · CVSS 8.1 · 2021-12-03 | 8.1 | 83% | 2021-12-03 |
| CVE-2026-45659In CISA KEVExploitedMicrosoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2026-05-22 | 8.8 | 80% | 2026-05-22 |
| CVE-2018-15133In CISA KEVExploitedIn Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. T…Laravel · Laravel Framework · CVSS 8.1 · 2018-08-09 | 8.1 | 77% | 2018-08-09 |
| CVE-2018-0824In CISA KEVExploitedA remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Executi…Microsoft · Windows · CVSS 7.5 · 2018-05-09 | 7.5 | 73% | 2018-05-09 |
| CVE-2020-5741In CISA KEVExploitedDeserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.Plex · Plex Media Server (Windows) · CVSS 7.2 · 2020-05-08 | 7.2 | 73% | 2020-05-08 |
| CVE-2022-21445In CISA KEVExploitedVulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0…Oracle Corporation · Application Development Framework (ADF) · CVSS 9.8 · 2022-04-19 | 9.8 | 62% | 2022-04-19 |
| CVE-2018-4939In CISA KEVExploitedAdobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploi…Adobe · Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update… · CVSS 9.8 · 2018-05-19 | 9.8 | 62% | 2018-05-19 |
| CVE-2025-53690In CISA KEVExploitedSitecore Products ViewState Deserialization VulnerabilitySitecore · Experience Manager (XM) · CVSS 9 · 2025-09-03 | 9.0 | 61% | 2025-09-03 |
| CVE-2023-21529In CISA KEVExploitedMicrosoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23 · CVSS 8.8 · 2023-02-14 | 8.8 | 59% | 2023-02-14 |
| CVE-2024-38094In CISA KEVExploitedMicrosoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 7.2 · 2024-07-09 | 7.2 | 51% | 2024-07-09 |
| CVE-2026-12569In CISA KEVExploitedRemote Code Execution (RCE) vulnerability in Windchill PDMlinkPTC · Windchill PDMLink · CVSS 9.3 · 2026-06-18 | 9.3 | 46% | 2026-06-18 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.