Deserialization

Everything Firewall Chronicle has reported about Deserialization: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Xorbits Xoscar Critical RCE via Unauthenticated TCP Channel Deserialization in CVE-2026-49950

An unauthenticated flaw in Xorbits Xoscar allows attackers to run arbitrary code via crafted data on TCP channels before message validation occurs.

Oct 13, 2026

Vulnerabilities

ThemeREX Let's Play CWE-502 Deserialization Bug CVE-2026-93935 Critical to v1.1.15

A critical deserialization flaw in ThemeREX Let's Play versions through 1.1.15 enables object injection attacks, posing severe risks to affected installations.

Oct 11, 2026