Insecure deserialization.

WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

• ThemeREX Orpheus
• Insecure deserialization

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

• ThemeREX Nuts
• Insecure deserialization

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

• ThemeREX Muzicon
• Insecure deserialization

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

• ThemeREX Motorix
• Insecure deserialization

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

• ThemeREX Mission
• Insecure deserialization

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

• ThemeREX Meals & Wheels
• Insecure deserialization

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

• ThemeREX Marcell
• Insecure deserialization

WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

• ThemeREX Le Truffe
• Insecure deserialization

WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

• ThemeREX Legal Stone
• Insecure deserialization

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

• Von Eyal Fitoussi GEO my WordPress
• Insecure deserialization

WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

• ThemeREX Ozisti
• Insecure deserialization

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

• ThemeREX Preservation
• Insecure deserialization

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

• ThemeREX Printy
• Insecure deserialization

WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

• ThemeREX Quirky
• Insecure deserialization

WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

• ThemeREX RexCoin
• Insecure deserialization

WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

• YayCommerce YayMail
• Insecure deserialization

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Insecure deserialization

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Insecure deserialization

Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection

• Frontend Dashboard
• ProfileGrid
• Insecure deserialization

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

• Insecure deserialization

<1.6.8 · fixed in 1.6.8

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

• Insecure deserialization

<0.32.0 · fixed in 0.32.0

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Ultralytics
• Insecure deserialization

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Ultralytics
• Insecure deserialization

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization

Deserialization of untrusted data in Jenkins

• Jenkins
• Insecure deserialization

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

• Ultimate Member
• Insecure deserialization

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

• stepasyuk Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters
• Insecure deserialization

WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

• crossi72 Phoenix Media Rename
• Insecure deserialization

WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

• weDevs Dokan
• Insecure deserialization

WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

• GS Plugins GS Logo Slider
• Insecure deserialization

WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability

• PickPlugins Accordion
• Insecure deserialization

Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

• rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
• Insecure deserialization

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

• FasterXML jackson-databind
• Insecure deserialization

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

• Insecure deserialization

<4.0.9 · fixed in 4.0.9

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

• Denial of service
• Insecure deserialization

>=4.0, <33.7.2 · fixed in 33.7.2

Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

• themeum Kirki – Freeform Page Builder, Website Builder & Customizer
• Insecure deserialization

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.

• Insecure deserialization

Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization

• Ndemic Creations Plague Inc Evolved
• Insecure deserialization
• CWE-20

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

• SteelRaven7 Ravenfield
• Insecure deserialization
• CWE-20

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

• Christoph Vielgrader Relevanssi
• Insecure deserialization

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

• Paytium
• Insecure deserialization

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

• Tribulant Software Newsletters
• Insecure deserialization

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

• codexonics Prime Mover – Backup and Migration
• Insecure deserialization

Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder

• huggingface datasets
• Insecure deserialization

baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity

• baserproject basercms
• Insecure deserialization

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

• AivahThemes Hostme v2
• Insecure deserialization

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

• axiomthemes Holistic Center
• Insecure deserialization

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

• ThemeREX ZenSoul
• Insecure deserialization

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

• ThemeREX Group Save Life
• Insecure deserialization

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

• ThemeREX Group HotLock
• Insecure deserialization

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

• ThemeREX Group Helion
• Insecure deserialization

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

• axiomthemes Hallelujah
• Insecure deserialization

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

• ThemeREX Group Vagabonds
• Insecure deserialization

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

• axiomthemes Reprizo
• Insecure deserialization

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

• axiomthemes Rhodos
• Insecure deserialization

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

• ThemeREX Group Little Birdies
• Insecure deserialization

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

• axiomthemes Redy
• Insecure deserialization

Remote Code Execution via Java Deserialization in CGM CLININET

• CGM CLININET
• Insecure deserialization

WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

• xnau webdesign Participants Database
• Insecure deserialization