# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62008.md) `CVE-2026-62008` · CVE record: ThemeREX Orpheus · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62006.md) `CVE-2026-62006` · CVE record: ThemeREX Nuts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62005.md) `CVE-2026-62005` · CVE record: ThemeREX Muzicon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62004.md) `CVE-2026-62004` · CVE record: ThemeREX Motorix · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62003.md) `CVE-2026-62003` · CVE record: ThemeREX Mission · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62002.md) `CVE-2026-62002` · CVE record: ThemeREX Meals & Wheels · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62001.md) `CVE-2026-62001` · CVE record: ThemeREX Marcell · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61998.md) `CVE-2026-61998` · CVE record: ThemeREX Le Truffe · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61997.md) `CVE-2026-61997` · CVE record: ThemeREX Legal Stone · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61992.md) `CVE-2026-61992` · CVE record: Von Eyal Fitoussi GEO my WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54860.md) `CVE-2026-54860` · CVE record: ThemeREX Ozisti · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54859.md) `CVE-2026-54859` · CVE record: ThemeREX Preservation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54858.md) `CVE-2026-54858` · CVE record: ThemeREX Printy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54857.md) `CVE-2026-54857` · CVE record: ThemeREX Quirky · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54856.md) `CVE-2026-54856` · CVE record: ThemeREX RexCoin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42701.md) `CVE-2026-42701` · CVE record: YayCommerce YayMail · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104317.md) `CVE-2026-104317` · CVE record: IBM Langflow OSS · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104324.md) `CVE-2026-104324` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-103693.md) `CVE-2026-103693` · CVE record: Unknown Frontend Dashboard and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check](https://agentprime.io/advisories/GHSA-7rv5-mrxv-xcr9.md) `GHSA-7rv5-mrxv-xcr9`, `CVE-2026-116580` · npm `seroval`: affected `<1.6.8`, fixed in `1.6.8` · CVSS 7.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [vLLM: Public multimodal SHM handle forgery reaches worker-side \`pickle.loads()\` with insecure serialization disabled](https://agentprime.io/advisories/GHSA-6757-hggm-hp2w.md) `GHSA-6757-hggm-hp2w`, `CVE-2026-115912`, `PYSEC-2026-4345` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118617.md) `CVE-2026-118617` · CVE record: Ultralytics Ultralytics · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118613.md) `CVE-2026-118613` · CVE record: Ultralytics Ultralytics · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-117624.md) `CVE-2026-117624` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-117613.md) `CVE-2026-117613` · CVE record: Jenkins Project Jenkins · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-117612.md) `CVE-2026-117612` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115968.md) `CVE-2026-115968` · CVE record: Ultimate Member Ultimate Member · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116390.md) `CVE-2026-116390` · CVE record: stepasyuk Filter Everything\ — WordPress \& WooCommerce Filters · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116389.md) `CVE-2026-116389` · CVE record: crossi72 Phoenix Media Rename · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115590.md) `CVE-2026-115590` · CVE record: weDevs Dokan · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116391.md) `CVE-2026-116391` · CVE record: GS Plugins GS Logo Slider · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116392.md) `CVE-2026-116392` · CVE record: PickPlugins Accordion · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-1928.md) `CVE-2026-1928` · CVE record: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)](https://agentprime.io/advisories/CVE-2026-110879.md) `CVE-2026-110879` · CVE record: FasterXML jackson-databind · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization - [Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME](https://agentprime.io/advisories/GHSA-22qq-2fwx-7p67.md) `GHSA-22qq-2fwx-7p67`, `CVE-2026-114608` · PyPI `pylint`: affected `<4.0.9`, fixed in `4.0.9` · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Insecure deserialization - [Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation](https://agentprime.io/advisories/GHSA-xxph-c9ww-hj94.md) `GHSA-xxph-c9ww-hj94`, `CVE-2026-102554` · Maven `com.google.guava:guava`: affected `>=4.0, <33.7.2`, fixed in `33.7.2` · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, Insecure deserialization - [Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint](https://agentprime.io/advisories/CVE-2026-75891.md) `CVE-2026-75891` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Insecure deserialization - [An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.](https://agentprime.io/advisories/CVE-2026-115190.md) `CVE-2026-115190` · CVE record · CVSS 8.0 High · Not analysed yet · Published 26 Oct 2026 · Tags: Insecure deserialization - [Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization](https://agentprime.io/advisories/CVE-2026-116230.md) `CVE-2026-116230` · CVE record: Ndemic Creations Plague Inc Evolved · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization](https://agentprime.io/advisories/CVE-2026-116098.md) `CVE-2026-116098` · CVE record: SteelRaven7 Ravenfield · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-114704.md) `CVE-2026-114704` · CVE record: Christoph Vielgrader Relevanssi · CVSS 7.2 High · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization - [WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-114196.md) `CVE-2026-114196` · CVE record: paytiumsupport Paytium · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization - [WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94075.md) `CVE-2026-94075` · CVE record: Tribulant Software Newsletters · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization - [Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace](https://agentprime.io/advisories/CVE-2026-115806.md) `CVE-2026-115806` · CVE record: codexonics Prime Mover – Backup and Migration · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization - [Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder](https://agentprime.io/advisories/CVE-2026-57845.md) `CVE-2026-57845` · CVE record: huggingface datasets · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity](https://agentprime.io/advisories/CVE-2026-114624.md) `CVE-2026-114624` · CVE record: baserproject basercms · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112848.md) `CVE-2026-112848` · CVE record: AivahThemes Hostme v2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112854.md) `CVE-2026-112854` · CVE record: axiomthemes Holistic Center · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112847.md) `CVE-2026-112847` · CVE record: ThemeREX ZenSoul · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112846.md) `CVE-2026-112846` · CVE record: ThemeREX Group Save Life · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112851.md) `CVE-2026-112851` · CVE record: ThemeREX Group HotLock · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112852.md) `CVE-2026-112852` · CVE record: ThemeREX Group Helion · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112853.md) `CVE-2026-112853` · CVE record: axiomthemes Hallelujah · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112856.md) `CVE-2026-112856` · CVE record: ThemeREX Group Vagabonds · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112857.md) `CVE-2026-112857` · CVE record: axiomthemes Reprizo · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112858.md) `CVE-2026-112858` · CVE record: axiomthemes Rhodos · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112859.md) `CVE-2026-112859` · CVE record: ThemeREX Group Little Birdies · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112855.md) `CVE-2026-112855` · CVE record: axiomthemes Redy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [Remote Code Execution via Java Deserialization in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30047.md) `CVE-2025-30047` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization - [WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112862.md) `CVE-2026-112862` · CVE record: xnau webdesign Participants Database · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .