Weakness class · DESER
Deserialization and Object Injection
4,376 published CVEs name a weakness in this class; 72 of them are exploited in the wild.
CWEs in this class7
| CWE | Weakness | CVEs | Exploited | Check |
|---|---|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | 3,542 | 70 | 52 |
| CWE-1321 | Prototype Pollution | 589 | 1 | 4 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 154 | 0 | 2 |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | 79 | 1 | 3 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | 6 | 0 | 0 |
| CWE-627 | Dynamic Variable Evaluation | 5 | 0 | 0 |
| CWE-621 | Variable Extraction Error | 1 | 0 | 0 |
Exploited and check counts are given for the class's largest CWEs; open a CWE for its CVEs.
Data as of 2026-11-14.