CWE-502

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.groupon.jenkins-ci.plugins:DotCi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.40.00"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-41237"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-06T21:30:50Z",
    "nvd_published_at": "2022-09-21T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.\n\nThis results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify `.ci.yml` files in SCM. This plugin has been suspended.",
  "id": "GHSA-x3jj-rgw9-7r5g",
  "modified": "2022-12-06T21:30:50Z",
  "published": "2022-09-22T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41237"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/DotCi"
    },
    {
      "type": "WEB",
      "url": "https://plugins.jenkins.io/DotCi"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1737"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/plugins/#suspensions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RCE vulnerability in Jenkins DotCi Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.5"
            },
            {
              "fixed": "0.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-29783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-19T15:55:58Z",
    "nvd_published_at": "2025-03-19T16:15:32Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nWhen vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts.\n\n### Details\n1. Pickle deserialization vulnerabilities are [well documented](https://docs.python.org/3/library/pickle.html).\n2. The [mooncake pipe](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L206) is exposed over the network (by design to enable disaggregated prefilling across distributed environments) using ZMQ over TCP, greatly increasing exploitability. ~~Further, the mooncake integration opens these sockets listening on all interfaces on the host, meaning it can not be configured to only use a private, trusted network.~~\n\nOnly `sender_socket` and `receiver_ack` are allowed to be accessed publicly, while the data actually decompressed by `pickle.loads()` comes from [recv_bytes](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257). Its interface is defined as `self.receiver_socket.connect(f\\\"tcp://{d_host}:{d_rank_offset + 1}\\\")`, where `d_host` is `decode_host`, a locally defined address 192.168.0.139,from mooncake.json (https://github.com/kvcache-ai/Mooncake/blob/main/doc/en/vllm-integration-v0.2.md?plain=1#L36).\n\n3. The root problem is [`recv_tensor()`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L257) calls [`_recv_impl`](https://github.com/vllm-project/vllm/blob/9bebc9512f9340e94579b9bd69cfdc452c4d5bb0/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L244) which passes the raw network bytes to `pickle.loads()`. Additionally, it does not appear that there are any controls (network, authentication, etc) to prevent arbitrary users from sending this payload to the affected service.\n\n\n\n### Impact\nThis is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts.\n\n### Remediation\nThis issue is resolved by https://github.com/vllm-project/vllm/pull/14228",
  "id": "GHSA-x3m8-f7g5-qhm7",
  "modified": "2025-07-02T14:20:40Z",
  "published": "2025-03-19T15:55:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29783"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/14228"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/288ca110f68d23909728627d3100e5a8db820aa2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-63.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM Allows Remote Code Execution via Mooncake Integration"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-29047"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-03T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.",
  "id": "GHSA-x3pf-797q-q9j6",
  "modified": "2022-05-24T17:43:31Z",
  "published": "2022-05-24T17:43:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29047"
    },
    {
      "type": "WEB",
      "url": "https://appcheck-ng.com/cve-2020-29047"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/wp-hotel-booking/#developers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-40368"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T18:17:15Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.",
  "id": "GHSA-x3r3-x95v-wx99",
  "modified": "2026-05-12T18:30:44Z",
  "published": "2026-05-12T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40368"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-32507"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T17:17:02Z",
    "severity": "MODERATE"
  },
  "details": "Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through \u003c 1.4.",
  "id": "GHSA-x46f-v56p-c92m",
  "modified": "2026-03-25T21:30:35Z",
  "published": "2026-03-25T18:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32507"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/leroux/vulnerability/wordpress-leroux-theme-1-4-arbitrary-object-instantiation-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-4416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T08:16:18Z",
    "severity": "HIGH"
  },
  "details": "The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation.",
  "id": "GHSA-x497-46w3-2gh7",
  "modified": "2026-03-30T09:31:28Z",
  "published": "2026-03-30T09:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4416"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-10806-fbc4a-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-10805-a53f6-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36964"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-29T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.",
  "id": "GHSA-x499-m338-rw37",
  "modified": "2022-12-02T00:30:26Z",
  "published": "2022-11-29T21:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36964"
    },
    {
      "type": "WEB",
      "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm"
    },
    {
      "type": "WEB",
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36964"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "qiskit-ibm-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "0.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-29032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-20T15:44:22Z",
    "nvd_published_at": "2024-03-20T21:15:31Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(\u003cibm_cloud_credentials\u003e)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don\u0027t know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it\u0027s definitely a security hole for anyone using the library to deserialize third-party data)",
  "id": "GHSA-x4x5-jv3x-9c7m",
  "modified": "2024-03-20T21:37:56Z",
  "published": "2024-03-20T15:44:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-x4x5-jv3x-9c7m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29032"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Qiskit/qiskit-ibm-runtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ibis-framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-17T21:47:11Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nDeserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.\n\nNote that Ibis itself makes **extremely limited** use of `pyarrow.parquet.read_table`:\n\n1. `read_table` is used in tests, where the input file is entirely controlled by the Ibis developers\n2. `read_table` is used in the `ibis/examples/__init__.py` as a fallback for backends that don\u0027t support reading Parquet directly. Parquet data used in `ibis.examples` are also managed by the Ibis developers. This Parquet data is generated from CSV files and SQLite databases.\n3. The Pandas and Dask backends both use PyArrow to read Parquet files and are therefore affected.\n\nIbis **does not** make use of APIs that directly read from either Arrow IPC files or Feather files.\n\n### Patches\n\nIbis imports the `pyarrow_hotfix` package wherever pyarrow is used, as of version 7.1.0.\n\nUpgrading to Arrow 14.0.1 is also a possible solution, starting in Ibis 7.1.0.\n\n### Workarounds\n\nInstall [`pyarrow_hotfix`](https://pypi.org/project/pyarrow-hotfix/) and run `import pyarrow_hotfix` ahead of any and all `import ibis` statements.\n\nFor example:\n\n```python\nimport ibis\n```\n\nbecomes\n\n```python\nimport pyarrow_hotfix\nimport ibis\n```\n\n### References\n\nhttps://www.cve.org/CVERecord?id=CVE-2023-47248\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47248",
  "id": "GHSA-x563-6hqv-26mr",
  "modified": "2023-11-17T21:47:11Z",
  "published": "2023-11-17T21:47:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ibis-project/ibis/security/advisories/GHSA-x563-6hqv-26mr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ibis-project/ibis/commit/0fa1e5dc06783c01e912e8de4d7e10186ca0e364"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ibis-project/ibis"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ibis-project/ibis/releases/tag/7.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-2442"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-06T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Migration, Backup, Staging \u2013 WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the \u0027path\u0027 parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.",
  "id": "GHSA-x57g-xj73-77gw",
  "modified": "2026-04-08T21:31:44Z",
  "published": "2022-09-07T00:01:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2442"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1747"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1783"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php\u0026new=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=cve"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}