CWE-502: Deserialization of Untrusted Data vulnerabilities

CVE-2026-62003 is a critical vulnerability in ThemeREX Mission versions up to 1.22, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVE-2026-62001 is a critical vulnerability in ThemeREX Marcell versions up to 1.2.14 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-61998 is a critical vulnerability in ThemeREX Le Truffe versions up to 1.1.7 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61997 is a critical vulnerability in ThemeREX Legal Stone versions up to 1.2.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61992 is a critical vulnerability in GEO my WordPress plugin versions up to 4.5.5.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-54860 is a critical vulnerability in ThemeREX Ozisti versions up to 1.1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

CVE-2026-54858 is a critical vulnerability in ThemeREX Printy versions up to 1.13.0 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-54857 is a critical vulnerability in ThemeREX Quirky versions up to 1.23 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-54856 is a critical vulnerability in ThemeREX RexCoin versions up to 1.2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-42701 is a high-severity vulnerability in YayCommerce's YayMail plugin versions up to 4.4.6. It involves PHP Object Injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. The flaw requires shop manager privileges to exploit and does not require user interaction.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to deserialization of untrusted data, which could allow a remote attacker with access to the message broker to execute arbitrary code on the system. This vulnerability has a high severity rating with a CVSS score of 8.1.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to deserialization of untrusted data, which could allow a remote authenticated attacker to execute arbitrary code. This vulnerability has a high severity rating with a CVSS score of 8.8. No public exploits or patches are currently documented.

CVE-2026-103693 is a critical vulnerability affecting the Frontend Dashboard and ProfileGrid WordPress plugins before versions 3.0.5 and 6.0.0.5 respectively. It allows unauthenticated users to store serialized PHP objects in user metadata, which are then deserialized when public profiles are viewed. This PHP object injection can lead to arbitrary file writes and potential remote code execution.

CVE-2026-118617 is a high-severity vulnerability in Ultralytics version 8.4.65 involving deserialization of untrusted data in the load_dataset_cache_file function. This flaw allows remote attackers to execute arbitrary code with the privileges of the current user if the user interacts with malicious content, such as visiting a crafted webpage or opening a malicious file.

CVE-2026-118613 is a high-severity vulnerability in Ultralytics version 8.4.65 involving deserialization of untrusted data in the torch_load function. This flaw allows remote attackers to execute arbitrary code with the privileges of the current user if the user interacts with malicious content. Exploitation requires user interaction, such as visiting a malicious webpage or opening a crafted file.

The Rank Math SEO plugin for WordPress contains a PHP Object Injection vulnerability via deserialization of untrusted input in the updateMeta REST API endpoint. This affects all versions up to and including 1.0.276. Authenticated users with Contributor-level access or higher can exploit this flaw to inject PHP objects. Exploitation can lead to remote code execution by writing a webshell to the uploads directory.

CVE-2026-110879 is a critical deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.10.0 up to but excluding fixed releases 2.18.12, 2.21.8, 2.22.4, 3.1.8, and 3.2.4. The flaw allows attacker-controlled classes inside generic type arguments to bypass validation, enabling deserialization of malicious objects. This can lead to arbitrary code execution, notably when combined with Spring on the classpath, allowing attackers to execute commands via crafted XML input.

The Kirki plugin for WordPress has a deserialization vulnerability in versions up to and including 6.2.5. This flaw allows authenticated users with Subscriber-level access or higher to perform PHP Object Injection via an AJAX endpoint lacking proper capability checks. Exploitation can lead to privilege escalation, enabling attackers to overwrite administrator passwords and gain full administrative control.