Everything Patch Observer has reported about Deserialization: 5 stories, newest first. Part of our Vulnerabilities coverage.
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection, requiring immediate attention for managed service providers.
Unauthenticated remote code execution in Xorbits Xoscar through 0.11.2 poses immediate risk to exposed TCP channels and privileged servers.
The NVD rates CVE-2026-93927 as critical, warning that Axiomthemes Veto versions up to 1.6.0 allow object injection through untrusted data.
A critical deserialization vulnerability in ThemeREX Group Smart Casa allows remote object injection, requiring immediate attention for users on versions up to 1.0.12.
A critical deserialization flaw in Microsoft Dataverse allows network-based code execution, posing severe risks to managed service providers.