CWE-502

{
  "affected": [],
  "aliases": [
    "CVE-2016-0360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-15T19:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference #: 1983457.",
  "id": "GHSA-jx28-c3hv-9f4g",
  "modified": "2022-05-17T02:25:41Z",
  "published": "2022-05-17T02:25:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0360"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21983457"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/95317"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1037561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-40757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T14:17:52Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated PHP Object Injection in Ch\u00e2teau \u003c= 1.2.1 versions.",
  "id": "GHSA-jx8h-mr4g-vm74",
  "modified": "2026-06-17T18:35:55Z",
  "published": "2026-06-17T18:35:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40757"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/chateau/vulnerability/wordpress-chateau-theme-1-2-1-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.9"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "sglang"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-3060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T17:38:54Z",
    "nvd_published_at": "2026-03-12T12:15:59Z",
    "severity": "CRITICAL"
  },
  "details": "SGLang\u0027s encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.",
  "id": "GHSA-jx93-g359-86wm",
  "modified": "2026-04-07T22:14:15Z",
  "published": "2026-03-12T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3060"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/pull/20904"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sgl-project/sglang"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation/encode_receiver.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/releases/tag/v0.5.10"
    },
    {
      "type": "WEB",
      "url": "https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SGLang\u0027s encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-32603"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-18T09:15:15Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.20.",
  "id": "GHSA-jxrj-72jp-j9h8",
  "modified": "2026-01-09T18:31:30Z",
  "published": "2024-04-18T09:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32603"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wc4bp/wordpress-woobuddy-plugin-3-4-20-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-24T21:16:27Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.",
  "id": "GHSA-jxv2-vgwx-37vv",
  "modified": "2026-03-24T21:31:24Z",
  "published": "2026-03-24T21:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24141"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5798"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "picklescan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-71321"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T15:22:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nPicklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.\n\n### Details\nThis is another vulnerability which impacts the downstream user.\n\nBy constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.\n\n### PoC\n```python\nimport pickle\nimport distutils.file_util\n\nclass FileWriteBypass:\n    def __reduce__(self):\n        \n        target_file = \"pwned_config.env\"\n        content = [\"print(\u0027I have overwritten your config\u0027)\"]\n        \n        return (distutils.file_util.write_file, (target_file, content))\n\npayload = pickle.dumps(FileWriteBypass())\nwith open(\"bypass_filewrite.pkl\", \"wb\") as f:\n    f.write(payload)\n\nprint(\"bypass_filewrite.pkl\")\n```\n\n\u003cimg width=\"853\" height=\"197\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65\" /\u003e\n\nTo fix this just add disutil to the blacklist",
  "id": "GHSA-m273-6v24-x4m4",
  "modified": "2026-06-18T14:44:27Z",
  "published": "2025-12-29T15:22:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71321"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/pull/53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mmaitre314/picklescan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-file-writing-via-distutils-module-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Picklescan vulnerable to Arbitrary File Writing"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "laravel/reverb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23524"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T15:40:24Z",
    "nvd_published_at": "2026-01-21T22:15:50Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nThis vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (`REVERB_SCALING_ENABLED=true`).\n\nThe exploitability of this vulnerability is increased because Redis servers are commonly deployed without authentication.\n\nWith horizontal scaling enabled, Reverb servers communicate via Redis PubSub. Reverb previously passed data from the Redis channel directly into PHP\u2019s `unserialize()` function without restricting which classes could be instantiated.\n\n**Risk:** Remote Code Execution (RCE)\n\n### Patches\nThis vulnerability is fixed in Laravel Reverb v1.7.0.\n\nUpdate your dependency to `laravel/reverb: ^1.7.0` immediately.\n\n### Workarounds\nIf you cannot upgrade to v1.7.0, you should apply the following mitigations:\n\n* Redis Security: Require a strong password for Redis access and ensure the service is only accessible via a private network or local loopback.\n* Disable Scaling: If your environment uses only one Reverb node, set `REVERB_SCALING_ENABLED=false` to bypass the vulnerable logic entirely.\n\n### Credits\nThis vulnerability was discovered and responsibly reported by Mohammad Yaser Abo-Elmaaty @m0h4mmad",
  "id": "GHSA-m27r-m6rx-mhm4",
  "modified": "2026-01-22T15:39:36Z",
  "published": "2026-01-21T15:40:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/laravel/reverb/security/advisories/GHSA-m27r-m6rx-mhm4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23524"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laravel/reverb/commit/9ec26f8ffbb701f84920dd0bb9781a1797591f1a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/laravel/reverb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/laravel/reverb/releases/tag/v1.7.0"
    },
    {
      "type": "WEB",
      "url": "https://laravel.com/docs/12.x/reverb#scaling"
    },
    {
      "type": "WEB",
      "url": "https://laravel.com/docs/reverb#scaling"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Redis Horizontal Scaling Insecure Deserialization"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-18601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-29T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a series of VOTE_Debug RPC calls to crash a database server within the SVOTE_Debug RPC handler.",
  "id": "GHSA-m28x-w8m6-pc3f",
  "modified": "2024-04-04T02:36:02Z",
  "published": "2022-05-24T17:00:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18601"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://openafs.org/pages/security/OPENAFS-SA-2019-003.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmailer/phpmailer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.8"
            },
            {
              "fixed": "6.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-36326"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-641"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-30T19:41:24Z",
    "nvd_published_at": "2021-04-28T03:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nThis is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8.  An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP\u0027s support for `.phar` files`. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info.\n\n### Patches\nThis issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected.\n\n### Workarounds\nValidate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can\u0027t be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it\u0027s not a problem specific to PHPMailer.\n\n### Credit\nThis issue was found by Fariskhi Vidyan, reported and managed via Tidelift.",
  "id": "GHSA-m298-fh5c-jc66",
  "modified": "2021-05-10T19:27:44Z",
  "published": "2021-05-04T17:42:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PHPMailer/PHPMailer/security/advisories/GHSA-m298-fh5c-jc66"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36326"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2020-36326.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PHPMailer/PHPMailer/releases/tag/v6.4.1"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Object injection in PHPMailer/PHPMailer"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.mchange:mchange-commons-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T18:20:05Z",
    "nvd_published_at": "2026-02-25T17:25:39Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nmchange-commons-java includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code.\n\nImplementations of this functionality within the JDK were disabled by default behind a System property that defaults to `false`, `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that implementation could be provoked to download and execute malicious code even after the JDK was hardened.\n\n### Patches\nMirroring the JDK patch, mchange-commons-java\u0027s JNDI functionality is now gated by configuration parameters that default to restrictive values. Those parameters are documented [here](https://www.mchange.com/projects/c3p0/#configuring_security).\n\n### Workarounds\nNo. Users should upgrade to mchange-commons-java \u003e= 0.4.0. Earlier versions should be avoided on application CLASSPATHs.\n\n### References\n\n[c3p0, you little rascal \u0026mdash; Hans-Martin M\u00fcnch](https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal/)\n[c3p0 documentation, security note](https://www.mchange.com/projects/c3p0/#security-note)\n[c3p0 documentation, configuring security](https://www.mchange.com/projects/c3p0/#configuring_security)",
  "id": "GHSA-m2cm-222f-qw44",
  "modified": "2026-02-27T20:55:40Z",
  "published": "2026-02-25T18:20:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27727"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/swaldman/mchange-commons-java"
    },
    {
      "type": "WEB",
      "url": "https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal"
    },
    {
      "type": "WEB",
      "url": "https://www.mchange.com/projects/c3p0/#configuring_security"
    },
    {
      "type": "WEB",
      "url": "https://www.mchange.com/projects/c3p0/#security-note"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "mchange-commons-java: Remote Code Execution via JNDI Reference Resolution"
}