A critical deserialization of untrusted data vulnerability (CVE-2026-93933) exists in ThemeREX Group Rosalinda theme, allowing object injection. This affects Rosalinda versions up to 1.2.4. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in ThemeREX Group Smart Casa smart-casa, allowing object injection. This affects versions up to and including 1.0.12. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-93931) exists in ThemeREX Group Smash, allowing object injection. This affects Smash versions up to and including 1.12.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is currently available.
A critical deserialization of untrusted data vulnerability (CVE-2026-93930) exists in ThemeREX Group Tantra tantra, allowing object injection. This vulnerability affects Tantra versions up to and including 2.9.0. It has a high CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-93929) exists in ThemeREX Group Travesia travesia versions up to 1.1.16. This vulnerability allows object injection, which can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges or user interaction required. No patch or remediation information is currently provided.
Axiomthemes Veto versions up to 1.6.0 are affected by a deserialization of untrusted data vulnerability that allows object injection. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability. It is identified as CVE-2026-93927 with a critical severity score of 9.8.
A deserialization of untrusted data vulnerability (CWE-502) exists in YITH WooCommerce Affiliates plugin versions up to 3.31.0. This vulnerability allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, indicating a high severity issue. No patch or remediation details are provided in the available data.
The Online Scheduling and Appointment Booking System – Bookly WordPress plugin is affected by a PHP Object Injection vulnerability through deserialization of untrusted input in the 'value' parameter. This affects all versions up to and including 28.2. The vulnerability requires authenticated attackers with custom-level access or higher. No known exploit gadget chains are currently available. The vulnerability has a high severity rating with a CVSS score of 7.2.
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.2.1 contains a PHP Object Injection vulnerability via deserialization of untrusted input. This vulnerability requires authenticated users with edit_course capability roles, such as Instructor or Administrator, and is exploitable during lesson creation when a temporary lesson ID triggers a custom metadata path. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, attackers may delete files, retrieve sensitive data, or execute code.
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
CVE-2026-100730 is a critical deserialization vulnerability in Grid Protection Alliance's openPDC and openHistorian products. It involves a service console interface that deserializes client-supplied data. On systems without Windows Authentication, this interface is accessible to unauthenticated network attackers; with Windows Authentication, attackers must be authenticated. Exploitation could allow remote code execution with the privileges of the affected service account.
CVE-2026-88131 is a critical vulnerability in Microsoft Dataverse involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute arbitrary code remotely without any user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this issue.
CVE-2026-78401 is a critical vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows remote unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-78406 is a critical vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows remote unauthenticated attackers to execute arbitrary code via deserialization of untrusted data. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed.
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.
This issue affects The Events Calendar: from n/a through 6.17.4.
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.
This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
LMCache versions from 0.3.9 up to but not including 0.5.6 contain a critical deserialization vulnerability in multiprocess (distributed) mode. This mode opens an unauthenticated ZeroMQ ROUTER socket that accepts msgpack messages. When processing these messages, the server calls pickle.loads on untrusted data before request handling, allowing remote code execution as the LMCache process user. Official containers run this process as root, increasing risk. The vulnerability is fixed in version 0.5.6, which removes the unsafe pickle.loads call.