# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files](https://agentprime.io/advisories/CVE-2026-120859.md) `CVE-2026-120859` · CVE record: PyMoDAQ PyMoDAQ and 3 more · CVSS 8.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection, Insecure deserialization - [h5io before 0.2.6 Arbitrary Code Execution via read_hdf5](https://agentprime.io/advisories/CVE-2026-120499.md) `CVE-2026-120499` · CVE record: h5io h5io · CVSS 8.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection, Insecure deserialization - [ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution](https://agentprime.io/advisories/CVE-2026-102739.md) `CVE-2026-102739` · CVE record: francescopace espectre · CVSS 7.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Insecure deserialization - [Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92190.md) `CVE-2026-92190` · CVE record: Quest Foglight for Databases · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Insecure deserialization - [MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118627.md) `CVE-2026-118627` · CVE record: MLflow MLflow · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Insecure deserialization - [MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118623.md) `CVE-2026-118623` · CVE record: MLflow MLflow · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Insecure deserialization - [Report Deserialization Code Execution](https://agentprime.io/advisories/CVE-2026-115731.md) `CVE-2026-115731` · CVE record: Perforce Puppet Enterprise · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, Insecure deserialization - [Stanza: RCE via pickle deserialization in the lemmatizer](https://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5.md) `GHSA-gh9r-c94j-cmp5`, `CVE-2026-115878` · PyPI `stanza`: affected `>=1.14.0, <1.15.0`, fixed in `1.15.0` · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, Insecure deserialization - [Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution](https://agentprime.io/advisories/GHSA-h26j-4vp7-x9w2.md) `GHSA-h26j-4vp7-x9w2`, `CVE-2026-62848` · NuGet `Metalama.Framework`: affected `<2025.1.18 || >=2026.0.1-preview, <2026.0.25 || >=2026.1.0-preview, <2026.1.19`, fixed in `2025.1.18`, `2026.0.25`, `2026.1.19` · CVSS 7.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Insecure deserialization, CWE-913 - [labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch](https://agentprime.io/advisories/CVE-2026-120833.md) `CVE-2026-120833` · CVE record: NIST labbench · CVSS 8.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Insecure deserialization - [Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field](https://agentprime.io/advisories/CVE-2026-102435.md) `CVE-2026-102435` · CVE record: themefic Ultra Addons for Contact Form 7 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Insecure deserialization - [jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization](https://agentprime.io/advisories/CVE-2026-120320.md) `CVE-2026-120320` · CVE record: jxxghp MoviePilot · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Insecure deserialization, CWE-20 - [Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder](https://agentprime.io/advisories/CVE-2026-118636.md) `CVE-2026-118636` · CVE record: Apache Software Foundation Apache MINA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Insecure deserialization - [PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field](https://agentprime.io/advisories/CVE-2026-109220.md) `CVE-2026-109220` · CVE record: addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Insecure deserialization - [OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution](https://agentprime.io/advisories/CVE-2026-63393.md) `CVE-2026-63393` · CVE record: opensearch-project sql · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Fickling check_safety() bypass: dotted \_\_qualname\_\_ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis](https://agentprime.io/advisories/CVE-2026-118938.md) `CVE-2026-118938` · CVE record: trailofbits fickling · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization, CWE-706 - [Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables](https://agentprime.io/advisories/CVE-2026-16760.md) `CVE-2026-16760` · CVE record: trailofbits fickling · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization, CWE-693 - [WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118090.md) `CVE-2026-118090` · CVE record: Stylemix MasterStudy LMS · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118089.md) `CVE-2026-118089` · CVE record: RexTheme Product Feed Manager · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-90888.md) `CVE-2026-90888` · CVE record: leadsnap LeadSnap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78527.md) `CVE-2026-78527` · CVE record: GS Plugins GS Testimonial Slider · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73186.md) `CVE-2026-73186` · CVE record: ShortPixel Enable Media Replace · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39738.md) `CVE-2026-39738` · CVE record: Aman FunnelKit Automations · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-119526.md) `CVE-2026-119526` · CVE record: ThemeREX Royal Event · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount](https://agentprime.io/advisories/CVE-2026-61803.md) `CVE-2026-61803` · CVE record: frappe lms · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-119706.md) `CVE-2026-119706` · CVE record: InternLM lmdeploy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-93327.md) `CVE-2026-93327` · CVE record: Google Cloud Application Integration · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Chamilo LMS: Database-backed PHP object injection in career deserialization](https://agentprime.io/advisories/CVE-2026-45145.md) `CVE-2026-45145` · CVE record: chamilo chamilo-lms · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field](https://agentprime.io/advisories/CVE-2026-103039.md) `CVE-2026-103039` · CVE record: Gravity Forms Gravity Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer](https://agentprime.io/advisories/CVE-2026-114422.md) `CVE-2026-114422` · CVE record: Unknown Enable Media Replace · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275](https://agentprime.io/advisories/CVE-2026-118562.md) `CVE-2026-118562` · CVE record: Drupal Single Content Sync · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center](https://agentprime.io/advisories/CVE-2026-107238.md) `CVE-2026-107238` · CVE record: Veeam Management Pack for Microsoft System Center · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center](https://agentprime.io/advisories/CVE-2023-22793.md) `CVE-2023-22793` · CVE record: Veeam Management Pack for Microsoft System Center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name](https://agentprime.io/advisories/CVE-2026-119120.md) `CVE-2026-119120` · CVE record: unclecode crawl4ai · CVSS 7.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118081.md) `CVE-2026-118081` · CVE record: 10Web 10Web Social Photo Feed · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118080.md) `CVE-2026-118080` · CVE record: Social Snap Social Snap · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118079.md) `CVE-2026-118079` · CVE record: FolioVision FV Flowplayer Video Player · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118078.md) `CVE-2026-118078` · CVE record: PixelYourSite Product Catalog Feed by PixelYourSite · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118077.md) `CVE-2026-118077` · CVE record: Fast Themes Sastra Essential Addons for Elementor · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118076.md) `CVE-2026-118076` · CVE record: Frisbii Frisbii Pay · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118075.md) `CVE-2026-118075` · CVE record: dbarrere WP Media folders · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118074.md) `CVE-2026-118074` · CVE record: Daman Jeet Finale Lite · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-118073.md) `CVE-2026-118073` · CVE record: blazethemes News Kit Elementor Addons · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116869.md) `CVE-2026-116869` · CVE record: myPOS Payments myPOS Checkout · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116868.md) `CVE-2026-116868` · CVE record: BuddyDev BuddyPress Xprofile Custom Field Types · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116867.md) `CVE-2026-116867` · CVE record: sosidee Dynamic QR Code \– generator · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116866.md) `CVE-2026-116866` · CVE record: Dotstore Extra Fees Plugin for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116865.md) `CVE-2026-116865` · CVE record: Gesundheit Bewegt GmbH Zippy · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-116864.md) `CVE-2026-116864` · CVE record: Arni Cinco WPCargo Track & Trace · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62131.md) `CVE-2026-62131` · CVE record: Zoho Flow Zoho Flow · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62018.md) `CVE-2026-62018` · CVE record: ThemeREX Gunslinger · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62017.md) `CVE-2026-62017` · CVE record: ThemeREX Good Homes · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62016.md) `CVE-2026-62016` · CVE record: ThemeREX Gamic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62015.md) `CVE-2026-62015` · CVE record: ThemeREX Gamezone · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62014.md) `CVE-2026-62014` · CVE record: ThemeREX EmojiNation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62013.md) `CVE-2026-62013` · CVE record: ThemeREX Edge Decor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62012.md) `CVE-2026-62012` · CVE record: ThemeREX Coinpress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62011.md) `CVE-2026-62011` · CVE record: ThemeREX Bonbon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62010.md) `CVE-2026-62010` · CVE record: ThemeREX Avventure · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization - [WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62009.md) `CVE-2026-62009` · CVE record: ThemeREX Filmax · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .