#CWE-502
All CosmicBytez Labs articles tagged #CWE-502, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-104747: Unauthenticated PHP Object Injection in the Haaken WordPress Theme
The Haaken WordPress theme (≤ 1.5) allows unauthenticated PHP object injection via insecure deserialization, rated CVSS 8.1.
- Security
CVE-2026-7654: PHP Object Injection RCE in WordPress Admin Columns Plugin (≤ 7.0.18)
A high-severity PHP Object Injection vulnerability in the Admin Columns WordPress plugin (versions up to 7.0.18) allows authenticated attackers to achieve…
- Security
CVE-2026-48207: Apache Fury PyFury Deserialization RCE
A critical deserialization vulnerability in Apache Fury's Python library PyFury allows attackers to bypass DeserializationPolicy validation hooks via the...
- Security
CVE-2026-7301: SGLang ROUTER Socket Exposes Unsafe
A critical CVSS 9.8 vulnerability in SGLang's multimodal AI runtime scheduler binds its ROUTER socket to 0.0.0.0 by default and passes incoming messages...
- Security
CVE-2026-25449: Critical Object Injection in Shinetheme
A CVSS 9.8 deserialization vulnerability in the Shinetheme Traveler WordPress plugin allows unauthenticated remote attackers to inject arbitrary PHP...
- Security
CVE-2026-25769: Wazuh Critical RCE via Insecure
A critical remote code execution vulnerability (CVSS 9.1) in Wazuh versions 4.0.0–4.14.2 allows an attacker with access to a worker node to achieve root...