# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [GLPI Database Inventory Plugin Vulnerable to Stored Object Injection](https://agentprime.io/advisories/CVE-2025-65035.md)
  `CVE-2025-65035` · CVE record: pluginsGLPI databaseinventory · CVSS 6.4 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Insecure deserialization
- [Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization](https://agentprime.io/advisories/GHSA-v4p2-2w39-mhrj.md)
  `GHSA-v4p2-2w39-mhrj`, `BIT-nifi-2025-66524`, `CVE-2025-66524` · Maven `org.apache.nifi:nifi-asana-processors`: affected `>=1.20.0, <2.7.0`, fixed in `2.7.0` · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2025 · Tags: Insecure deserialization
- [Genymobile/scrcpy <= 3.3.3 Global Buffer Overflow](https://agentprime.io/advisories/CVE-2025-34449.md)
  `CVE-2025-34449` · CVE record: Genymobile scrcpy · CVSS 6.9 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-64266.md)
  `CVE-2025-64266` · CVE record: magepeopleteam Booking and Rental Manager · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-64233.md)
  `CVE-2025-64233` · CVE record: BoldThemes Codiqa · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-64227.md)
  `CVE-2025-64227` · CVE record: BoldGrid Client Invoicing by Sprout Invoices · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-64206.md)
  `CVE-2025-64206` · CVE record: TieLabs Jannah · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60180.md)
  `CVE-2025-60180` · CVE record: CRM Perks WP Gravity Forms Salesforce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60178.md)
  `CVE-2025-60178` · CVE record: CRM Perks WP Gravity Forms HubSpot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60174.md)
  `CVE-2025-60174` · CVE record: CRM Perks WP Gravity Forms Constant Contact Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60091.md)
  `CVE-2025-60091` · CVE record: CRM Perks WP Gravity Forms Zoho CRM and Bigin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60090.md)
  `CVE-2025-60090` · CVE record: CRM Perks WP Gravity Forms Insightly · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60089.md)
  `CVE-2025-60089` · CVE record: CRM Perks WP Gravity Forms FreshDesk Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60084.md)
  `CVE-2025-60084` · CVE record: add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60083.md)
  `CVE-2025-60083` · CVE record: add-ons.org PDF Invoice Builder for WooCommerce · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60082.md)
  `CVE-2025-60082` · CVE record: add-ons.org PDF for WPForms · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-60081.md)
  `CVE-2025-60081` · CVE record: add-ons.org PDF for Contact Form 7 · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60080.md)
  `CVE-2025-60080` · CVE record: add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-54723.md)
  `CVE-2025-54723` · CVE record: BoldThemes DentiCare · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07).](https://agentprime.io/advisories/CVE-2025-63951.md)
  `CVE-2025-63951` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28).](https://agentprime.io/advisories/CVE-2025-63950.md)
  `CVE-2025-63950` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Isaac Lab](https://agentprime.io/advisories/CVE-2025-33210.md)
  `CVE-2025-33210` · CVE record: NVIDIA Isaac Lab · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2025 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33226.md)
  `CVE-2025-33226` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 16 Dec 2025 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33212.md)
  `CVE-2025-33212` · CVE record: NVIDIA NeMo Framework · CVSS 7.3 High · Not analysed yet · Published 16 Dec 2025 · Tags: Insecure deserialization
- [Fickling has Code Injection vulnerability via pty.spawn()](https://agentprime.io/advisories/GHSA-r7v6-mfhq-g3m2.md)
  `GHSA-r7v6-mfhq-g3m2`, `CVE-2025-67748`, `PYSEC-2025-113` · PyPI `fickling`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 7.1 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection, Insecure deserialization, CWE-184
- [Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list](https://agentprime.io/advisories/GHSA-565g-hwwr-4pp3.md)
  `GHSA-565g-hwwr-4pp3`, `CVE-2025-67747`, `PYSEC-2026-1368` · PyPI `fickling`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 7.1 High · Not analysed yet · Published 15 Dec 2025 · Tags: Insecure deserialization, CWE-184
- [Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2025-9121.md)
  `CVE-2025-9121` · CVE record: Hitachi Vantara Pentaho Data Integration and Analytics · CVSS 8.8 High · Not analysed yet · Published 15 Dec 2025 · Tags: Insecure deserialization
- [Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versions](https://agentprime.io/advisories/GHSA-vr6p-vq2p-6j74.md)
  `GHSA-vr6p-vq2p-6j74` · npm `likec4`: affected `<=1.46.1`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 15 Dec 2025 · Tags: Insecure deserialization
- [MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool.](https://agentprime.io/advisories/CVE-2025-65213.md)
  `CVE-2025-65213` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2025 · Tags: Insecure deserialization
- [tiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization](https://agentprime.io/advisories/CVE-2025-14606.md)
  `CVE-2025-14606` · CVE record: tiny-rdm Tiny RDM · CVSS 2.3 Low · Not analysed yet · Published 13 Dec 2025 · Tags: Insecure deserialization, CWE-20
- [Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import](https://agentprime.io/advisories/CVE-2025-14476.md)
  `CVE-2025-14476` · CVE record: unitecms Doubly – Cross Domain Copy Paste for WordPress · CVSS 8.8 High · Not analysed yet · Published 13 Dec 2025 · Tags: Insecure deserialization
- [Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up](https://agentprime.io/advisories/GHSA-5j59-xgg2-r9c4.md)
  `GHSA-5j59-xgg2-r9c4`, `CVE-2025-67779` · npm `next`: affected `>=13.3.1-canary.0, <14.2.35 || >=15.0.6, <15.0.7 || >=15.1.10, <15.1.11 || >=15.2.7, <15.2.8 || >=15.3.7, <15.3.8 || >=15.4.9, <15.4.10 || >=15.5.8, <15.5.9 || >=15.6.0-canary.59, <15.6.0-canary.60 || >=16.0.9, <16.0.10 || >=16.1.0-canary.17, <16.1.0-canary.19`, fixed in `14.2.35`, `15.0.7`, `15.1.11`, `15.2.8`, `15.3.8`, `15.4.10`, `15.5.9`, `15.6.0-canary.60`, `16.0.10`, `16.1.0-canary.19` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 12 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-c6m7-q6pr-c64r.md)
  `GHSA-c6m7-q6pr-c64r` · npm `@vitejs/plugin-rsc`: affected `<0.5.7`, fixed in `0.5.7` · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Information disclosure, Insecure deserialization, CWE-1395
- [Vite Plugin React has a Denial of Service Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-cpqf-f22c-r95x.md)
  `GHSA-cpqf-f22c-r95x` · npm `@vitejs/plugin-rsc`: affected `<0.5.7`, fixed in `0.5.7` · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [Denial of Service Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-7gmr-mq3h-m5h9.md)
  `GHSA-7gmr-mq3h-m5h9`, `CVE-2025-67779` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.2, <19.0.3 || >=19.1.3, <19.1.4 || >=19.2.2, <19.2.3`, fixed in `19.0.3`, `19.1.4`, `19.2.3` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 12 Dec 2025 · Tags: Denial of service, Insecure deserialization
- [Apache HugeGraph-Server: RAFT and deserialization vulnerability](https://agentprime.io/advisories/GHSA-q37j-3367-fwv7.md)
  `GHSA-q37j-3367-fwv7`, `CVE-2025-26866` · Maven `org.apache.hugegraph:hg-pd-core`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 8.8 High · Not analysed yet · Published 12 Dec 2025 · Tags: Insecure deserialization
- [Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie](https://agentprime.io/advisories/CVE-2025-14044.md)
  `CVE-2025-14044` · CVE record: rodgerholl Visitor Logic Lite · CVSS 8.1 High · Not analysed yet · Published 12 Dec 2025 · Tags: Insecure deserialization
- [Next Server Actions Source Code Exposure](https://agentprime.io/advisories/GHSA-w37m-7fhw-fmv9.md)
  `GHSA-w37m-7fhw-fmv9`, `CVE-2025-55183` · npm `next`: affected `>=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17`, fixed in `15.0.6`, `15.1.10`, `15.2.7`, `15.3.7`, `15.4.9`, `15.5.8`, `15.6.0-canary.59`, `16.0.9`, `16.1.0-canary.17` · CVSS 5.3 Medium · EPSS 0.62 · Not analysed yet · Published 11 Dec 2025 · Tags: Information disclosure, Insecure deserialization, CWE-1395
- [Next Vulnerable to Denial of Service with Server Components](https://agentprime.io/advisories/GHSA-mwv6-3258-q52c.md)
  `GHSA-mwv6-3258-q52c`, `CVE-2025-55184` · npm `next`: affected `>=13.3.0, <14.2.34 || >=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17`, fixed in `14.2.34`, `15.0.6`, `15.1.10`, `15.2.7`, `15.3.7`, `15.4.9`, `15.5.8`, `15.6.0-canary.59`, `16.0.9`, `16.1.0-canary.17` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.64 · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [Denial of Service Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-2m3v-v2m8-q956.md)
  `GHSA-2m3v-v2m8-q956`, `CVE-2025-55184` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.2 || >=19.1.0, <19.1.3 || >=19.2.0, <19.2.2`, fixed in `19.0.2`, `19.1.3`, `19.2.2` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.64 · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service, Insecure deserialization
- [Source Code Exposure Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-925w-6v3x-g4j4.md)
  `GHSA-925w-6v3x-g4j4`, `CVE-2025-55183` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.2 || >=19.1.0, <19.1.3 || >=19.2.0, <19.2.2`, fixed in `19.0.2`, `19.1.3`, `19.2.2` · CVSS 5.3 Medium · EPSS 0.62 · Not analysed yet · Published 11 Dec 2025 · Tags: Information disclosure, Insecure deserialization
- [Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE](https://agentprime.io/advisories/CVE-2025-34394.md)
  `CVE-2025-34394` · CVE record: Barracuda Networks RMM · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Insecure deserialization
- [Arbitrary Code Execution in Google Cloud Data Fusion via Malicious Artifact Upload](https://agentprime.io/advisories/CVE-2025-9571.md)
  `CVE-2025-9571` · CVE record: Google Cloud Cloud Data Fusion · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Insecure deserialization
- [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2025-61810.md)
  `CVE-2025-61810` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)](https://agentprime.io/advisories/CVE-2025-66214.md)
  `CVE-2025-66214` · CVE record: wearefrank ladybug · CVSS 7.0 High · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [Entrust Instant Financial Issuance (IFI) Legacy Remoting Service .NET Remoting RCE](https://agentprime.io/advisories/CVE-2025-34414.md)
  `CVE-2025-34414` · CVE record: Entrust Corporation Instant Financial Issuance (IF) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NVTabular](https://agentprime.io/advisories/CVE-2025-33214.md)
  `CVE-2025-33214` · CVE record: NVIDIA NVTabular · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Merlin Transformers4Rec](https://agentprime.io/advisories/CVE-2025-33213.md)
  `CVE-2025-33213` · CVE record: NVIDIA Merlin Transformers4Rec · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67535.md)
  `CVE-2025-67535` · CVE record: Flipper Code - WordPress Development Company WP Maps · CVSS 6.6 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [Deserialization Vulnerability in SAP jConnect - SDK for ASE](https://agentprime.io/advisories/CVE-2025-42928.md)
  `CVE-2025-42928` · CVE record: SAP_SE SAP jConnect - SDK for ASE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization
- [Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)](https://agentprime.io/advisories/GHSA-wq34-7f4g-953v.md)
  `GHSA-wq34-7f4g-953v`, `CVE-2025-66631` · NuGet `Csla`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 7.2 High · Not analysed yet · Published 8 Dec 2025 · Tags: Insecure deserialization
- [HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.](https://agentprime.io/advisories/CVE-2025-63721.md)
  `CVE-2025-63721` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: Insecure deserialization
- [UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection](https://agentprime.io/advisories/CVE-2025-66571.md)
  `CVE-2025-66571` · CVE record: Unknown UNA CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2025 · Tags: Insecure deserialization
- [React Server Components are Vulnerable to RCE](https://agentprime.io/advisories/GHSA-fmh4-wr37-44fp.md)
  `GHSA-fmh4-wr37-44fp` · npm `@vitejs/plugin-rsc`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Dec 2025 · Tags: Insecure deserialization
- [React Server Components are Vulnerable to RCE](https://agentprime.io/advisories/GHSA-fv66-9v8q-g76r.md)
  `GHSA-fv66-9v8q-g76r`, `CVE-2025-55182` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.1 || >=19.1.0, <19.1.2 || >=19.2.0, <19.2.1`, fixed in `19.0.1`, `19.1.2`, `19.2.1` · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 3 Dec 2025 · Tags: Insecure deserialization
- [Next.js is vulnerable to RCE in React flight protocol](https://agentprime.io/advisories/GHSA-9qr9-h5gf-34mp.md)
  `GHSA-9qr9-h5gf-34mp`, `CVE-2025-55182` · npm `next`: affected `>=14.3.0-canary.77, <15.0.5 || >=15.1.0-canary.0, <15.1.9 || >=15.2.0-canary.0, <15.2.6 || >=15.3.0-canary.0, <15.3.6 || >=15.4.0-canary.0, <15.4.8 || >=15.5.0-canary.0, <15.5.7 || >=16.0.0-canary.0, <16.0.7`, fixed in `15.0.5`, `15.1.9`, `15.2.6`, `15.3.6`, `15.4.8`, `15.5.7`, `16.0.7` · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 3 Dec 2025 · Tags: Insecure deserialization
- [CODESYS Development System - Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2025-41700.md)
  `CVE-2025-41700` · CVE record: CODESYS CODESYS Development System · CVSS 7.8 High · Not analysed yet · Published 1 Dec 2025 · Tags: Insecure deserialization
- [NutzBoot vulnerable to deserialization](https://agentprime.io/advisories/GHSA-fgmj-6h3v-4q56.md)
  `GHSA-fgmj-6h3v-4q56`, `CVE-2025-13805` · Maven `org.nutz:nutzboot-parent`: affected `<=2.6.0-SNAPSHOT`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Insecure deserialization, CWE-20
- [Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search](https://agentprime.io/advisories/CVE-2025-9191.md)
  `CVE-2025-9191` · CVE record: favethemes Houzez · CVSS 6.3 Medium · Not analysed yet · Published 26 Nov 2025 · Tags: Insecure deserialization
- [Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer](https://agentprime.io/advisories/GHSA-xv5p-fjw5-vrj6.md)
  `GHSA-xv5p-fjw5-vrj6`, `CVE-2025-62703`, `PYSEC-2026-1399` · PyPI `fugue`: affected `<=0.9.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 25 Nov 2025 · Tags: Command injection, Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI1LTExLTI1VDIwOjM5OjE1LjAwMDAwMFoiLCJHSFNBLXh2NXAtZmp3NS12cmo2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI1LTEyLTE5VDIxOjMxOjA1LjAwMDAwMFoiLCJHSFNBLTRoeDktNDh4aC01bXhyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI1LTEyLTE5VDIxOjMxOjA1LjAwMDAwMFoiLCJHSFNBLTRoeDktNDh4aC01bXhyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.