Advisories · Weakness

Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-65674 CVE record

CVSS 8.8 High

Microsoft SQL Server Remote Code Execution Vulnerability
- Microsoft SQL Server 2019 (GDR)
- Microsoft SQL Server 2019 for x64-based Systems (CU32)
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-49950 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
- xorbitsai xoscar
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-93905 CVE record

CVSS 8.2 High

IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data
- IBM WebSphere Application Server - Liberty
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-105442 CVE record

CVSS 7.5 High

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-105013 CVE record

CVSS 7.4 High

Microsoft Office SharePoint Remote Code Execution Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-100214 CVE record

CVSS 8.8 High

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
- Microsoft Dynamics NAV 2017
- Microsoft Dynamics NAV 2018
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-96186 CVE record

CVSS 7.8 High

Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-87692 CVE record

CVSS 7.8 High

Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-85900 CVE record

CVSS 8.8 High

Microsoft Office SharePoint Remote Code Execution Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-88091 CVE record

CVSS 7.8 High

Windows Management Instrumentation Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-65180 CVE record

CVSS 7.8 High

Deserialization of untrusted data in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-65110 CVE record

CVSS 7.8 High

Deserialization of untrusted data in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Insecure deserialization
Not analysed yet 13 Oct 2026
CVE-2026-108958 CVE record

CVSS 5.3 Medium

TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
- TensorLayer
- Insecure deserialization
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-108947 CVE record

CVSS 4.8 Medium

yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization
- yoshitomo-matsubara torchdistill
- Insecure deserialization
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-109361 CVE record

CVSS 7.0 High

MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
- MONAI
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-109360 CVE record

CVSS 7.7 High

MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP
- MONAI
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-109237 CVE record

CVSS 8.6 High

Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables
- unclecode crawl4ai
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-109391 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
- Square Squash
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-12613 CVE record

CVSS 8.8 High

Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor
- Ministry of Justice General Directorate of Information Technology UYAP Document Editor
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-52903 CVE record

CVSS 8.8 High

YAML safe_load production fallback to unsafe_load enables RCE via deserialization
- ManageIQ
- Red Hat CloudForms
- Insecure deserialization
Not analysed yet 12 Oct 2026
CVE-2026-81797 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
- ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-78535 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
- ThemeRex Photolia
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-78533 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability
- AncoraThemes Qwery
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-78531 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
- ThemeREX Jacqueline
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-78529 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability
- ThemeREX Alliance
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66569 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability
- axiomthemes Kicker
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66568 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
- axiomthemes Original
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66567 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
- AncoraThemes Anesta
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66565 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
- axiomthemes FC United
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66564 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
- ThemeREX ShiftCV
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66563 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
- ThemeREX Windsor
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66483 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
- ThemeREX Education Center
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-66482 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
- AncoraThemes Drone Media
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62130 CVE record

CVSS 7.2 High

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability
- Amir Helzer WooCommerce Multilingual & Multicurrency
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62125 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
- ThemeREX Asia Garden
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62124 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
- ThemeREX N7 | Golf Club Sports & Events
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62123 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
- ThemeREX Invetex
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62120 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
- ThemeREX Law Office
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62090 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
- ThemeREX WineShop
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62087 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
- ThemeREX Equadio
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62086 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
- ThemeREX Juno
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62077 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
- BoldThemes Avala
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62076 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
- The4 Kalles
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62054 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
- ThemeREX Yacht Rental
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62053 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
- ThemeREX Wine House
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62052 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
- ThemeREX Tipsy
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62051 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
- ThemeREX Stargaze
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62050 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
- ThemeREX Splendour
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62021 CVE record

CVSS 8.8 High

WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability
- rascals Angio
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-42723 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
- AncoraThemes CleanSkin
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-42719 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability
- Sarah Giles Dynamic User Directory
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-42718 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability
- Pluggabl Booster for WooCommerce
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-42716 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability
- Payever - WooCommerce Gateway
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-104398 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
- VillaTheme AFFI – Affiliate Marketing for WooCommerce
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62044 CVE record

CVSS 7.2 High

WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability
- bPlugins Super Video Player
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-94676 CVE record

CVSS 7.2 High

WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability
- Tainacan
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-105885 CVE record

CVSS 8.8 High

WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
- Slider by 10Web
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62045 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability
- ThemeREX Group Booklovers
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-62046 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability
- ThemeREX Group Gutentype
- Insecure deserialization
Not analysed yet 10 Oct 2026
CVE-2026-93945 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability
- Axiomthemes Balance
- Insecure deserialization
Not analysed yet 10 Oct 2026