High Severity
Published: Oct 25, 2026
Compiled dataset of Java deserialization CVEs
# Java-Deserialization-CVEs
This is a dataset of CVEs related to Java Deserialization. Since existing CVE databases do not allow for granular searches by vulnerability type and language, this list was compiled by manually searching the NIST NVD CVE database with different queries. If you notice any discrepancies, contributions are very welcome!
| CVE ID | Year | CVSS 3/3.1 risk | CVSS 2 risk |
| --------------------------------------------------------------------- | ---- | --------------- | ----------- |
| [CVE-2004-2540](https://nvd.nist.gov/vuln/detail/CVE-2004-2540) | 2004 | | 5 |
| [CVE-2005-0223](https://nvd.nist.gov/vuln/detail/CVE-2005-0223) | 2005 | | 5 |
| [CVE-2005-3583](https://nvd.nist.gov/vuln/detail/CVE-2005-3583) | 2005 | | 7.8 |
| [CVE-2006-6745](https://nvd.nist.gov/vuln/detail/CVE-2006-6745) | 2006 | | 9.3 |
| [CVE-2008-1013](https://nvd.nist.gov/vuln/detail/CVE-2008-1013) | 2008 | | 6.8 |
| [CVE-2008-5353](https://nvd.nist.gov/vuln/detail/CVE-2008-5353) | 2008 | | 10 |
| [CVE-2009-1094](https://nvd.nist.gov/vuln/detail/CVE-2009-1094) | 2009 | | 10 |
| [CVE-2009-1103](https://nvd.nist.gov/vuln/detail/CVE-2009-1103) | 2009 | | 6.4 |
| [CVE-2009-1190](https://nvd.nist.gov/vuln/detail/CVE-2009-1190) | 2009 | | 5 |
| [CVE-2009-2723](https://nvd.nist.gov/vuln/detail/CVE-2009-2723) | 2009 | | 10 |
| [CVE-2010-0094](https://nvd.nist.gov/vuln/detail/CVE-2010-0094) | 2010 | | 7.