CWE-915 · Deserialization and Object Injection
Improperly Controlled Modification of Dynamically-Determined Object Attributes
154CVEs
0exploited
2with a public check
3likely (EPSS 10%+)
SortMost likely exploited
154 CVEs with CWE-915 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-33453CheckApache Camel camel-coap - Remote Code ExecutionApache Software Foundation · Apache Camel · CVSS 10 · 2026-04-27 | 10.0 | 9.2% | 2026-04-27 |
| CVE-2026-50160CheckHoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwritehoppscotch · hoppscotch · CVSS 10 · 2026-07-01 | 10.0 | 1.7% | 2026-07-01 |
| CVE-2022-4068Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenmslibrenms · librenms/librenms · CVSS 7.6 · 2022-11-20 | 7.6 | 38% | 2022-11-20 |
| CVE-2024-5452RCE via Property/Class Pollution in lightning-ai/pytorch-lightninglightning-ai · lightning-ai/pytorch-lightning · CVSS 9.8 · 2024-06-06 | 9.8 | 27% | 2024-06-06 |
| CVE-2026-30822Flowise: Mass Assignment in `/api/v1/leads` EndpointFlowiseAI · Flowise · CVSS 7.7 · 2026-03-07 | 7.7 | 15% | 2026-03-07 |
| CVE-2022-43441A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary cod…Ghost Foundation · node-sqlite3 · CVSS 8.1 · 2023-03-16 | 8.1 | 2.4% | 2023-03-16 |
| CVE-2021-32811Remote Code Execution via Script (Python) objects under Python 3zopefoundation · Zope · CVSS 7.5 · 2021-08-02 | 7.5 | 2.3% | 2021-08-02 |
| CVE-2022-2625A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator t…Postgresql · postgresql · 2022-08-18 | – | 2.2% | 2022-08-18 |
| CVE-2021-32807Remote Code Execution via unsafe classes in otherwise permitted moduleszopefoundation · AccessControl · CVSS 4.4 · 2021-07-30 | 4.4 | 2.1% | 2021-07-30 |
| CVE-2022-24802Prototype Pollution in deepmerge-tsRebeccaStevens · deepmerge-ts · CVSS 8.1 · 2022-03-31 | 8.1 | 1.7% | 2022-03-31 |
| CVE-2021-21368Prototype poisoningmcollina · msgpack5 · CVSS 6.7 · 2021-03-12 | 6.7 | 1.6% | 2021-03-12 |
| CVE-2020-11066Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSTYPO3 · TYPO3 CMS · CVSS 8.7 · 2020-05-13 | 8.7 | 1.5% | 2020-05-13 |
| CVE-2026-27953ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructorormar-orm · ormar · CVSS 7.1 · 2026-03-19 | 7.1 | 1.2% | 2026-03-19 |
| CVE-2025-58367DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionseperman · deepdiff · CVSS 10 · 2025-09-05 | 10.0 | 1.2% | 2025-09-05 |
| CVE-2026-72710SPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionSPIP · SPIP · CVSS 9.8 · 2026-09-11 | 9.8 | 1.1% | 2026-09-11 |
| CVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypasscraftcms · cms · CVSS 8.7 · 2026-08-24 | 8.7 | 1.0% | 2026-08-24 |
| CVE-2024-55638Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008Drupal · Drupal Core · CVSS 9.8 · 2024-12-09 | 9.8 | 1.0% | 2024-12-09 |
| CVE-2024-3283Privilege Escalation via Mass Assignment in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 7.2 · 2024-04-10 | 7.2 | 0.9% | 2024-04-10 |
| CVE-2024-55636Drupal core - Less critical - Gadget chain - SA-CORE-2024-006Drupal · Drupal Core · CVSS 9.8 · 2024-12-09 | 9.8 | 0.9% | 2024-12-09 |
| CVE-2023-32079Netmaker Privilige Escalation Vulnerabilitygravitl · netmaker · CVSS 8.8 · 2023-08-24 | 8.8 | 0.9% | 2023-08-24 |
| CVE-2026-5708Improper Control of User-Modifiable Attributes in RES CreateSession APIAWS · Research and Engineering Studio (RES) · CVSS 8.8 · 2026-04-06 | 8.8 | 0.9% | 2026-04-06 |
| CVE-2024-55637Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007Drupal · Drupal Core · CVSS 9.8 · 2024-12-09 | 9.8 | 0.8% | 2024-12-09 |
| CVE-2026-17117Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 9.9 · 2026-11-07 | 9.9 | 0.8% | 2026-11-07 |
| CVE-2026-72778Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configcraftcms · cms · CVSS 8.8 · 2026-08-11 | 8.8 | 0.8% | 2026-08-11 |
| CVE-2024-0404Mass Assignment Vulnerability in mintplex-labs/anything-llmmintplex-labs · mintplex-labs/anything-llm · CVSS 9.1 · 2024-04-16 | 9.1 | 0.8% | 2024-04-16 |
| CVE-2026-18617Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator podRed Hat · Red Hat OpenShift AI 2.25 · CVSS 8.8 · 2026-08-10 | 8.8 | 0.7% | 2026-08-10 |
| CVE-2025-30358Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacksmesop-dev · mesop · CVSS 8.1 · 2025-03-27 | 8.1 | 0.7% | 2025-03-27 |
| CVE-2026-93752CSSOM through 0.5.0 Denial of Service via length PropertyNV · CSSOM · CVSS 7.5 · 2026-09-18 | 7.5 | 0.7% | 2026-09-18 |
| CVE-2025-69691Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they a…Pfsense · Pfsense · CVSS 9.9 · 2026-05-08 | 9.9 | 0.7% | 2026-05-08 |
| CVE-2026-90863Privilege Escalation via Missing Authorization in WS_FTP ManagerProgress Software · WS_FTP Server · CVSS 9.1 · 2026-10-29 | 9.1 | 0.7% | 2026-10-29 |
| CVE-2025-2304Camaleon CMS Privilege Escalationowen2345 · camaleon-cms · CVSS 9.4 · 2025-03-14 | 9.4 | 0.6% | 2025-03-14 |
| CVE-2023-39983MXsecurity Register Database PollutionMoxa · MXsecurity Series · CVSS 5.3 · 2023-09-02 | 5.3 | 0.6% | 2023-09-02 |
| CVE-2026-126081Action Pack: Possible Strong Parameters bypass in Parameters#each_keyrails · rails · CVSS 7.5 · 2026-11-10 | 7.5 | 0.6% | 2026-11-10 |
| CVE-2026-56142In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to account…JetBrains · Hub · CVSS 9.6 · 2026-06-19 | 9.6 | 0.6% | 2026-06-19 |
| CVE-2025-31674Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003Drupal · Drupal core · CVSS 7.5 · 2025-03-31 | 7.5 | 0.6% | 2025-03-31 |
| CVE-2026-32640(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.danthedeckie · simpleeval · CVSS 7.5 · 2026-03-13 | 7.5 | 0.6% | 2026-03-13 |
| CVE-2026-34208SandboxJS: Sandbox integrity escapenyariv · SandboxJS · CVSS 10 · 2026-04-06 | 10.0 | 0.6% | 2026-04-06 |
| CVE-2026-41139Unsafe array index getter in mathjsjosdejong · mathjs · CVSS 8.8 · 2026-05-07 | 8.8 | 0.6% | 2026-05-07 |
| CVE-2026-72719Chatwoot: Cross-Account Resource Transfer via `account_id` Parameterchatwoot · chatwoot · CVSS 6.7 · 2026-08-10 | 6.7 | 0.6% | 2026-08-10 |
| CVE-2026-9726Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038Drupal · Drupal AlternativeCommerce (Basket) · CVSS 9.8 · 2026-07-10 | 9.8 | 0.6% | 2026-07-10 |
| CVE-2026-12535Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048Drupal · Formatter Field · CVSS 9.8 · 2026-07-10 | 9.8 | 0.6% | 2026-07-10 |
| CVE-2026-112305Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Overridesemaphoreui · Semaphore UI · CVSS 8.8 · 2026-10-19 | 8.8 | 0.6% | 2026-10-19 |
| CVE-2026-34427Vvveb < 1.0.8.1 Privilege Escalation via admin/user/savegivanz · Vvveb · CVSS 8.8 · 2026-04-20 | 8.8 | 0.6% | 2026-04-20 |
| CVE-2026-6912Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops WheelAWS · AWS Ops Wheel · CVSS 8.8 · 2026-04-24 | 8.8 | 0.6% | 2026-04-24 |
| CVE-2026-40897Math.js: Unsafe object property setter in mathjsjosdejong · mathjs · CVSS 8.8 · 2026-04-24 | 8.8 | 0.6% | 2026-04-24 |
| CVE-2026-17095IBM i is Affected By Multiple Vulnerabilities in Navigator for iIBM · i · CVSS 8.3 · 2026-08-12 | 8.3 | 0.5% | 2026-08-12 |
| CVE-2026-22814Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM Stateadonisjs · lucid · CVSS 8.2 · 2026-01-13 | 8.2 | 0.5% | 2026-01-13 |
| CVE-2026-34406APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit EndpointAPTRS · APTRS · CVSS 9.4 · 2026-03-31 | 9.4 | 0.5% | 2026-03-31 |
| CVE-2025-15602Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege EscalationGrokability, Inc. · Snipe-IT · CVSS 8.8 · 2026-03-06 | 8.8 | 0.5% | 2026-03-06 |
| CVE-2026-17394Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 9.6 · 2026-11-07 | 9.6 | 0.5% | 2026-11-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.