9.8
Critical
CVE-2026-112856 Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue…
Description
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Vagabonds 1.3 | earliest → 1.3.10 | No fix stated |