#cwe-502

1 stories this week · 2 this month · 3 in 6 months · mostly security

Stories per day · 30 days

3 stories, newest first · one card per story

Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.

JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

Stories tagged #cwe-502