Insecure deserialization.

WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

• ThemeREX Group Camelia
• Insecure deserialization

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

• ThemeREX Group Convex
• Insecure deserialization

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

• ThemeREX Group Dwell
• Insecure deserialization

WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

• ThemeREX Group Edema
• Insecure deserialization

WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

• ThemeREX Group Greeny
• Insecure deserialization

WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

• ThemeREX Group Hogwords
• Insecure deserialization

WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

• ThemeREX Group Hygia
• Insecure deserialization

WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

• ThemeREX Group IPharm
• Insecure deserialization

WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

• ThemeREX Group Let's Play
• Insecure deserialization

WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

• ThemeREX Group Partiso
• Insecure deserialization

WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

• ThemeREX Group Rosalinda
• Insecure deserialization

WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

• ThemeREX Group Smart Casa
• Insecure deserialization

WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

• ThemeREX Group Smash
• Insecure deserialization

WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

• ThemeREX Group Tantra
• Insecure deserialization

WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

• ThemeREX Group Travesia
• Insecure deserialization

WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

• Axiomthemes Veto
• Insecure deserialization

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

• YITH WooCommerce Affiliates
• Insecure deserialization

Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

• ladela Online Scheduling and Appointment Booking System – Bookly
• Insecure deserialization

LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

• LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
• Insecure deserialization

WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

• BuddhaThemes ColorFolio
• Insecure deserialization

WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

• BuddhaThemes Neo | Barber Shop WordPress Theme
• Insecure deserialization

Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data

• Grid Protection Alliance openPDC
• Grid Protection Alliance openPDC (Docker image)
• Insecure deserialization

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

• ExpressTech Quiz And Survey Master
• Insecure deserialization

WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

• mklacroix Product Configurator for WooCommerce
• Insecure deserialization

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

• WP Hosting AS Pay with Vipps for WooCommerce
• Insecure deserialization

Microsoft Dataverse Remote Code Execution Vulnerability

• Microsoft Dataverse
• Insecure deserialization

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Insecure deserialization

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Insecure deserialization

WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

• MainWP Child
• Insecure deserialization

CVE-2026-93034

• SGLang
• Insecure deserialization

Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion

• uncannyowl Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included
• Insecure deserialization

Backstage: Improper validation of TechDocs MkDocs configuration

• Insecure deserialization

<1.15.4 · fixed in 1.15.4

WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

• Liquid Web / StellarWP The Events Calendar
• Insecure deserialization

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

• Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
• Insecure deserialization

Deserialization of untrusted data in Veeam Backup and Replication

• Veeam Backup and Replication
• Insecure deserialization

Unsafe Deserialization Vulnerability in Manacle Technologies ERP System

• Manacle Technologies Multi-tenant ERP System
• Insecure deserialization

String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

• String locator
• Insecure deserialization

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Insecure deserialization

Deserialization of untrusted data in NVIDIA Model-Optimizer

• NVIDIA Model-Optimizer
• Insecure deserialization

Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Insecure deserialization

Insecure deserialization in the TrueLayer Magento 2 plugin

• TrueLayer Magento 2 Plugin
• Insecure deserialization

WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

• Edge-Themes Haaken
• Insecure deserialization

WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

• Data443 Risk Mitigation, Inc. GDPR Framework By Data443
• Insecure deserialization

CVE-2026-82988

• Viewsonic vCast
• Authentication bypass
• Unrestricted file upload

WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

• WP Spell Check
• Insecure deserialization

WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

• Vektor Inc. VK Google Job Posting Manager
• Insecure deserialization

WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

• PressTigers Simple Event Planner
• Insecure deserialization

WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

• WP Sunshine Sunshine Photo Cart
• Insecure deserialization

WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

• Smackcoders Inc. WP Ultimate Exporter
• Insecure deserialization

WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

• Rymera Web Co Product Feed PRO for WooCommerce
• Insecure deserialization

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

• Liquid Web / StellarWP Advanced Post Manager
• Insecure deserialization

FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

• NeoRazorX facturascripts
• Insecure deserialization

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

• Insecure deserialization
• CWE-914

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

• Code injection
• Insecure deserialization

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

• Insecure deserialization

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

• Apache Software Foundation Apache Directory LDAP API
• Insecure deserialization

DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

• dhis2-core
• Insecure deserialization

Foreman: ssti and insecure deserialization in foreman-rake configuration

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Insecure deserialization

WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

• Icegram
• Insecure deserialization

WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability

• Dotstore Hide Shipping Method For WooCommerce
• Insecure deserialization