# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Deserialization of untrusted data in NVIDIA BioNeMo Framework](https://agentprime.io/advisories/CVE-2026-24165.md) `CVE-2026-24165` · CVE record: NVIDIA BioNeMo Framework · CVSS 7.8 High · Not analysed yet · Published 31 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA BioNeMo Framework](https://agentprime.io/advisories/CVE-2026-24164.md) `CVE-2026-24164` · CVE record: NVIDIA BioNeMo Framework · CVSS 8.8 High · Not analysed yet · Published 31 Mar 2026 · Tags: Insecure deserialization - [WatchGuard Firebox Insecure Deserialization in Fireware Access Portal](https://agentprime.io/advisories/CVE-2026-4266.md) `CVE-2026-4266` · CVE record: WatchGuard Fireware OS · CVSS 8.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: Insecure deserialization - [GIGABYTE｜Performance Library - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-4416.md) `CVE-2026-4416` · CVE record: GIGABYTE Performance Library · CVSS 8.5 High · Not analysed yet · Published 30 Mar 2026 · Tags: Insecure deserialization - [GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization](https://agentprime.io/advisories/CVE-2026-4851.md) `CVE-2026-4851` · CVE record: CASIANO GRID::Machine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2026 · Tags: Code injection, Insecure deserialization - [Saloon has insecure deserialization in AccessTokenAuthenticator](https://agentprime.io/advisories/GHSA-rf88-776r-rcq9.md) `GHSA-rf88-776r-rcq9`, `CVE-2026-33942`, `PKSA-xnj5-w74d-6wmz` · Packagist `saloonphp/saloon`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 8.1 High · Not analysed yet · Published 27 Mar 2026 · Tags: Insecure deserialization - [Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import](https://agentprime.io/advisories/CVE-2026-33725.md) `CVE-2026-33725` · CVE record: metabase metabase · CVSS 7.2 High · Not analysed yet · Published 27 Mar 2026 · Tags: Insecure deserialization - [splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-h8w2-rv57-vc6f.md) `GHSA-h8w2-rv57-vc6f` · Maven `com.splunk:splunk-otel-javaagent`: affected `<2.26.1`, fixed in `2.26.1` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization, CWE-1395 - [dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution](https://agentprime.io/advisories/GHSA-579q-h82j-r5v2.md) `GHSA-579q-h82j-r5v2`, `CVE-2026-33728` · Maven `com.datadoghq:dd-java-agent`: affected `>=0.40.0, <1.60.3`, fixed in `1.60.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization - [648540858 wvp-GB28181-pro API Endpoint RedisTemplateConfig.java GenericFastJsonRedisSerializer deserialization](https://agentprime.io/advisories/CVE-2026-4860.md) `CVE-2026-4860` · CVE record: 648540858 wvp-GB28181-pro · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization, CWE-20 - [Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts](https://agentprime.io/advisories/CVE-2026-3328.md) `CVE-2026-3328` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 7.2 High · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization - [OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-xw7x-h9fj-p2c7.md) `GHSA-xw7x-h9fj-p2c7`, `CVE-2026-33701` · Maven `io.opentelemetry.javaagent:opentelemetry-javaagent`: affected `<2.26.1`, fixed in `2.26.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32513.md) `CVE-2026-32513` · CVE record: Miguel Useche JS Archive List · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32512.md) `CVE-2026-32512` · CVE record: Edge-Themes Pelicula · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32511.md) `CVE-2026-32511` · CVE record: Mikado-Themes Stål · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32510.md) `CVE-2026-32510` · CVE record: Edge-Themes Kamperen · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32509.md) `CVE-2026-32509` · CVE record: Edge-Themes Gracey · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32508.md) `CVE-2026-32508` · CVE record: Mikado-Themes Halstein · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32507.md) `CVE-2026-32507` · CVE record: Elated-Themes Leroux · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerability](https://agentprime.io/advisories/CVE-2026-32506.md) `CVE-2026-32506` · CVE record: Edge-Themes Archicon · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32502.md) `CVE-2026-32502` · CVE record: Select-Themes Borgholm · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32484.md) `CVE-2026-32484` · CVE record: BoldGrid weForms · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27095.md) `CVE-2026-27095` · CVE record: magepeopleteam Bus Ticket Booking with Seat Reservation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27084.md) `CVE-2026-27084` · CVE record: ThemeREX Buisson · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27083.md) `CVE-2026-27083` · CVE record: ThemeREX Work & Travel Company · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27082.md) `CVE-2026-27082` · CVE record: ThemeREX Love Story · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27045.md) `CVE-2026-27045` · CVE record: sbthemes WooCommerce Infinite Scroll · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25429.md) `CVE-2026-25429` · CVE record: wpdive Nexa Blocks · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25400.md) `CVE-2026-25400` · CVE record: thememount Apicona · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25360.md) `CVE-2026-25360` · CVE record: rascals Vex · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25359.md) `CVE-2026-25359` · CVE record: rascals Pendulum · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25358.md) `CVE-2026-25358` · CVE record: rascals Meloo · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25032.md) `CVE-2026-25032` · CVE record: park_of_ideas Ricky · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25031.md) `CVE-2026-25031` · CVE record: park_of_ideas Tasty Daily · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Goldish theme < 3.47 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25030.md) `CVE-2026-25030` · CVE record: park_of_ideas Goldish · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25029.md) `CVE-2026-25029` · CVE record: park_of_ideas KIDZ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24989.md) `CVE-2026-24989` · CVE record: FantasticPlugins SUMO Affiliates Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24981.md) `CVE-2026-24981` · CVE record: NooTheme Visionary Core · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24978.md) `CVE-2026-24978` · CVE record: NooTheme Jobica Core · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24976.md) `CVE-2026-24976` · CVE record: NooTheme Organici Library · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24974.md) `CVE-2026-24974` · CVE record: NooTheme CitiLights · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24378.md) `CVE-2026-24378` · CVE record: Metagauss EventPrime · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-23971.md) `CVE-2026-23971` · CVE record: xtemos WoodMart · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22510.md) `CVE-2026-22510` · CVE record: AncoraThemes Melody · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22507.md) `CVE-2026-22507` · CVE record: AncoraThemes Beelove · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22505.md) `CVE-2026-22505` · CVE record: AncoraThemes Morning Records · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22500.md) `CVE-2026-22500` · CVE record: axiomthemes m2 | Construction and Tools Store · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22480.md) `CVE-2026-22480` · CVE record: WebToffee Product Feed for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization - [NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution](https://agentprime.io/advisories/GHSA-v7v2-m736-cf3c.md) `GHSA-v7v2-m736-cf3c`, `CVE-2026-24159`, `PYSEC-2026-2675` · PyPI `nemo-toolkit`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading](https://agentprime.io/advisories/GHSA-m4jw-wgmf-889x.md) `GHSA-m4jw-wgmf-889x`, `CVE-2026-24157`, `PYSEC-2026-2674` · PyPI `nemo-toolkit`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Model Optimizer](https://agentprime.io/advisories/CVE-2026-24141.md) `CVE-2026-24141` · CVE record: NVIDIA NVIDIA Model Optimizer · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Apex](https://agentprime.io/advisories/CVE-2025-33244.md) `CVE-2025-33244` · CVE record: NVIDIA Apex · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron LM](https://agentprime.io/advisories/CVE-2026-24152.md) `CVE-2026-24152` · CVE record: NVIDIA Megatron LM · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron LM](https://agentprime.io/advisories/CVE-2026-24151.md) `CVE-2026-24151` · CVE record: NVIDIA Megatron LM · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron LM](https://agentprime.io/advisories/CVE-2026-24150.md) `CVE-2026-24150` · CVE record: NVIDIA Megatron LM · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron LM](https://agentprime.io/advisories/CVE-2025-33248.md) `CVE-2025-33248` · CVE record: NVIDIA Megatron LM · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron LM](https://agentprime.io/advisories/CVE-2025-33247.md) `CVE-2025-33247` · CVE record: NVIDIA Megatron LM · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [A stack overflow and DoS vulnerability in DTStack/chunjun](https://agentprime.io/advisories/CVE-2026-4735.md) `CVE-2026-4735` · CVE record: DTStack chunjun · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Insecure deserialization - [A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be...](https://agentprime.io/advisories/PYSEC-2026-139.md) `PYSEC-2026-139`, `BIT-pytorch-2026-4538`, `CVE-2026-4538` · PyPI `torch`: affected `<=2.10.0`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Insecure deserialization, CWE-20 - [WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-0677.md) `CVE-2026-0677` · CVE record: TotalSuite TotalContest Lite · CVSS 6.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .