# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93944.md)
  `CVE-2026-93944` · CVE record: ThemeREX Group Camelia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93943.md)
  `CVE-2026-93943` · CVE record: ThemeREX Group Convex · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93942.md)
  `CVE-2026-93942` · CVE record: ThemeREX Group Dwell · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93941.md)
  `CVE-2026-93941` · CVE record: ThemeREX Group Edema · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93940.md)
  `CVE-2026-93940` · CVE record: ThemeREX Group Greeny · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93938.md)
  `CVE-2026-93938` · CVE record: ThemeREX Group Hogwords · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93937.md)
  `CVE-2026-93937` · CVE record: ThemeREX Group Hygia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93936.md)
  `CVE-2026-93936` · CVE record: ThemeREX Group IPharm · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93935.md)
  `CVE-2026-93935` · CVE record: ThemeREX Group Let's Play · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93934.md)
  `CVE-2026-93934` · CVE record: ThemeREX Group Partiso · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93933.md)
  `CVE-2026-93933` · CVE record: ThemeREX Group Rosalinda · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93932.md)
  `CVE-2026-93932` · CVE record: ThemeREX Group Smart Casa · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93931.md)
  `CVE-2026-93931` · CVE record: ThemeREX Group Smash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93930.md)
  `CVE-2026-93930` · CVE record: ThemeREX Group Tantra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93929.md)
  `CVE-2026-93929` · CVE record: ThemeREX Group Travesia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93927.md)
  `CVE-2026-93927` · CVE record: Axiomthemes Veto · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-106606.md)
  `CVE-2026-106606` · CVE record: YITH YITH WooCommerce Affiliates · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter](https://agentprime.io/advisories/CVE-2026-12626.md)
  `CVE-2026-12626` · CVE record: ladela Online Scheduling and Appointment Booking System – Bookly · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data](https://agentprime.io/advisories/CVE-2026-104723.md)
  `CVE-2026-104723` · CVE record: lifterlms LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94065.md)
  `CVE-2026-94065` · CVE record: BuddhaThemes ColorFolio · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94064.md)
  `CVE-2026-94064` · CVE record: BuddhaThemes Neo | Barber Shop WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-100730.md)
  `CVE-2026-100730` · CVE record: Grid Protection Alliance openPDC and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104392.md)
  `CVE-2026-104392` · CVE record: ExpressTech Quiz And Survey Master · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105872.md)
  `CVE-2026-105872` · CVE record: mklacroix Product Configurator for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94568.md)
  `CVE-2026-94568` · CVE record: WP Hosting AS Pay with Vipps for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Dataverse Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-88131.md)
  `CVE-2026-88131` · CVE record: Microsoft Microsoft Dataverse · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-78401.md)
  `CVE-2026-78401` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-78406.md)
  `CVE-2026-78406` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-105436.md)
  `CVE-2026-105436` · CVE record: MainWP MainWP Child · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [CVE-2026-93034](https://agentprime.io/advisories/CVE-2026-93034.md)
  `CVE-2026-93034` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2026-82627.md)
  `CVE-2026-82627` · CVE record: uncannyowl Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Backstage: Improper validation of TechDocs MkDocs configuration](https://agentprime.io/advisories/GHSA-qmw3-745m-w99g.md)
  `GHSA-qmw3-745m-w99g`, `CVE-2026-106558` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95606.md)
  `CVE-2026-95606` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95534.md)
  `CVE-2026-95534` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2025-64393.md)
  `CVE-2025-64393` · CVE record: Veeam Backup and Replication · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [Unsafe Deserialization Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-107104.md)
  `CVE-2026-107104` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor](https://agentprime.io/advisories/CVE-2026-97188.md)
  `CVE-2026-97188` · CVE record: Unknown String locator · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93447.md)
  `CVE-2026-93447` · CVE record: IBM Langflow OSS · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Model-Optimizer](https://agentprime.io/advisories/CVE-2026-65142.md)
  `CVE-2026-65142` · CVE record: NVIDIA Model-Optimizer · CVSS 7.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-76750.md)
  `CVE-2026-76750` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [Insecure deserialization in the TrueLayer Magento 2 plugin](https://agentprime.io/advisories/CVE-2026-103831.md)
  `CVE-2026-103831` · CVE record: TrueLayer TrueLayer Magento 2 Plugin · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104747.md)
  `CVE-2026-104747` · CVE record: Edge-Themes Haaken · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39797.md)
  `CVE-2026-39797` · CVE record: Data443 Risk Mitigation, Inc. GDPR Framework By Data443 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [CVE-2026-82988](https://agentprime.io/advisories/CVE-2026-82988.md)
  `CVE-2026-82988` · CVE record: Viewsonic vCast · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Unrestricted file upload, Insecure deserialization
- [WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-100506.md)
  `CVE-2026-100506` · CVE record: WP Spell Check WP Spell Check · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-100511.md)
  `CVE-2026-100511` · CVE record: Vektor Inc. VK Google Job Posting Manager · CVSS 8.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97257.md)
  `CVE-2026-97257` · CVE record: PressTigers Simple Event Planner · CVSS 8.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93617.md)
  `CVE-2026-93617` · CVE record: WP Sunshine Sunshine Photo Cart · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103348.md)
  `CVE-2026-103348` · CVE record: Smackcoders Inc. WP Ultimate Exporter · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103349.md)
  `CVE-2026-103349` · CVE record: Rymera Web Co Product Feed PRO for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97283.md)
  `CVE-2026-97283` · CVE record: Liquid Web / StellarWP Advanced Post Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect](https://agentprime.io/advisories/CVE-2026-104905.md)
  `CVE-2026-104905` · CVE record: NeoRazorX facturascripts · CVSS 6.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution](https://agentprime.io/advisories/CVE-2019-25777.md)
  `CVE-2019-25777` · CVE record · CVSS 7.3 High · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization, CWE-914
- [YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes](https://agentprime.io/advisories/CVE-2017-20285.md)
  `CVE-2017-20285` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Insecure deserialization
- [An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.](https://agentprime.io/advisories/CVE-2026-37719.md)
  `CVE-2026-37719` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements](https://agentprime.io/advisories/CVE-2026-103877.md)
  `CVE-2026-103877` · CVE record: Apache Software Foundation Apache Directory LDAP API · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Insecure deserialization
- [DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-55083.md)
  `CVE-2026-55083` · CVE record: dhis2 dhis2-core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Insecure deserialization
- [Foreman: ssti and insecure deserialization in foreman-rake configuration](https://agentprime.io/advisories/CVE-2026-12544.md)
  `CVE-2026-12544` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Insecure deserialization
- [WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97284.md)
  `CVE-2026-97284` · CVE record: Icegram Icegram · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94390.md)
  `CVE-2026-94390` · CVE record: Dotstore Hide Shipping Method For WooCommerce · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTEwLTAxVDE0OjMzOjU0Ljg4MjAwMFoiLCJDVkUtMjAyNi05NDM5MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTEwLTEwVDA3OjAwOjM4LjY3MTAwMFoiLCJDVkUtMjAyNi05Mzk0NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTEwLTEwVDA3OjAwOjM4LjY3MTAwMFoiLCJDVkUtMjAyNi05Mzk0NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.