Sign in Sign up
JA · EN · FR
SecPulse

Cwe 502

🧬 CWE Related 1,305
slug: cwe-502

Explanation

CWE-502は「シリアライズされたデータ (オブジェクトをバイト列に変換したもの) を信頼せずに復元 (デシリアライズ) してしまう」欠陥です。 Java・Python・PHP・.NETなどで、攻撃者が細工したオブジェクトを送ると任意コード実行されてしまうため、Webサーバー乗っ取りの典型ルートです。
📌 Example
CVE-2017-9805 (Apache Struts2 REST Plugin): XMLデシリアライズによるRCEで、Equifax事件 (1.4億人個人情報流出) の直接原因となった。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801

🛡 Vulnerabilities tagged with this 1,306

Image ID Title
CVE-2026-1184 Unsafe Deserialization in gitlab (CVE-2026-1184)
CVE-2026-41957 Unsafe Deserialization in Big Ip Access Policy Manager (CVE-2026-41957)
CVE-2026-45134 Unsafe Deserialization in langsmith (CVE-2026-45134)
CVE-2026-7635 Unsafe Deserialization in coreActivity: Activity Logging for (WordPress plugin) (CVE-2026-7635)
CVE-2026-34659 Unsafe Deserialization in Adobe Connect (CVE-2026-34659)
CVE-2026-35439 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-35439)
CVE-2026-40368 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-40368)
CVE-2026-40357 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-40357)
CVE-2026-33110 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-33110)
CVE-2026-33112 Unsafe Deserialization in Microsoft Sharepoint Server (CVE-2026-33112)
CVE-2026-31237 Unsafe Deserialization in ludwig (CVE-2026-31237)
CVE-2026-31238 Unsafe Deserialization in ludwig (CVE-2026-31238)
CVE-2026-31235 Unsafe Deserialization in imgaug (CVE-2026-31235)
CVE-2026-31239 Unsafe Deserialization in mamba-ssm (CVE-2026-31239)
CVE-2026-31229 The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization...
CVE-2026-31234 Unsafe Deserialization in horovod (CVE-2026-31234)
CVE-2026-31232 The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains...
CVE-2026-31221 Unsafe Deserialization in pytorch-lightning (CVE-2026-31221)
CVE-2026-31222 Unsafe Deserialization in snorkel (CVE-2026-31222)
CVE-2026-31223 Unsafe Deserialization in snorkel (CVE-2026-31223)
CVE-2026-31224 Unsafe Deserialization in snorkel (CVE-2026-31224)
CVE-2026-31214 The torch-checkpoint-shrink.py script in the ml-engineering project in commit...
CVE-2026-31218 The _load_model() function in the neural_magic_training.py script of the optimate project in...
CVE-2026-31219 The _load_model() function in the neural_magic_training.py script of the optimate project in...
CVE-2026-3048 Unsafe Deserialization in Sonatype Nexus Repository Manager (CVE-2026-3048)
CVE-2026-31249 CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...
CVE-2026-31250 CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...
CVE-2026-31253 Unsafe Deserialization in flash_attn (CVE-2026-31253)
CVE-2026-7818 Unsafe Deserialization in pgadmin4 (CVE-2026-7818)
CVE-2026-41586 Unsafe Deserialization in hyperledger-fabric-orderer (CVE-2026-41586)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details