# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Deserialization of untrusted data in NVIDIA FLARE SDK](https://agentprime.io/advisories/CVE-2026-24186.md) `CVE-2026-24186` · CVE record: NVIDIA FLARE SDK · CVSS 8.8 High · Not analysed yet · Published 28 Apr 2026 · Tags: Insecure deserialization - [Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.](https://agentprime.io/advisories/CVE-2025-60889.md) `CVE-2025-60889` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Insecure deserialization - [An issue was discovered in Cista v0.15 and below.](https://agentprime.io/advisories/CVE-2025-60887.md) `CVE-2025-60887` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Insecure deserialization - [Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)](https://agentprime.io/advisories/GHSA-f2wh-grmh-r6jm.md) `GHSA-f2wh-grmh-r6jm`, `CVE-2026-41409` · Maven `org.apache.mina:mina-core`: affected `>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6`, fixed in `2.0.28`, `2.1.11`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-5rc6-9qfp-8vwg.md) `GHSA-5rc6-9qfp-8vwg`, `CVE-2026-27172` · Maven `org.apache.camel:camel-consul`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1`, fixed in `4.14.6`, `4.18.1` · CVSS 6.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-4xwx-hvv7-7prj.md) `GHSA-4xwx-hvv7-7prj`, `CVE-2026-40858` · Maven `org.apache.camel:camel-infinispan`: affected `>=4.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.7`, `4.18.2`, `4.20.0` · CVSS 8.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Apache Camel's Camel-Mail component is vulnerable to Camel message header injection](https://agentprime.io/advisories/GHSA-2vqf-x7g4-7c2g.md) `GHSA-2vqf-x7g4-7c2g`, `CVE-2026-33454` · Maven `org.apache.camel:camel-mail`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1`, fixed in `4.14.6`, `4.18.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization, CWE-1173 - [Camel-MINA Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-vpr3-2659-rw55.md) `GHSA-vpr3-2659-rw55`, `CVE-2026-40473` · Maven `org.apache.camel:camel-mina`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 8.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage](https://agentprime.io/advisories/GHSA-m5vh-3fw5-5wgh.md) `GHSA-m5vh-3fw5-5wgh`, `CVE-2026-40860` · Maven `org.apache.camel:camel-activemq` and 5 more: affected `>=3.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.7`, `4.18.2`, `4.20.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Apache MINA vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-8297-v2rf-2p32.md) `GHSA-8297-v2rf-2p32`, `CVE-2026-41635` · Maven `org.apache.mina:mina-core`: affected `>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6`, fixed in `2.0.28`, `2.1.11`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [Camel-PQC Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-v3vg-332r-mw99.md) `GHSA-v3vg-332r-mw99`, `CVE-2026-40048` · Maven `org.apache.camel:camel-pqc`: affected `<4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.18.2`, `4.20.0` · CVSS 7.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization - [k8sGPT has Prompt Injection through its k8sGPT-Operator](https://agentprime.io/advisories/GHSA-rp7v-4384-hfrp.md) `GHSA-rp7v-4384-hfrp`, `GO-2026-5631` · Go `github.com/k8sgpt-ai/k8sgpt`: affected `<0.4.32`, fixed in `0.4.32` · CVSS 4.0, no score published · Not analysed yet · Published 24 Apr 2026 · Tags: Insecure deserialization, Broken access control, CWE-20 - [Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization](https://agentprime.io/advisories/GHSA-mw35-8rx3-xf9r.md) `GHSA-mw35-8rx3-xf9r`, `CVE-2026-41486`, `PYSEC-2026-2272`, `PYSEC-2026-2296` · PyPI `ray`: affected `>=2.49.0, <2.55.0`, fixed in `2.55.0` · CVSS 8.9 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, Insecure deserialization - [ERB has an @\_init deserialization guard bypass via def_module / def_method / def_class](https://agentprime.io/advisories/GHSA-q339-8rmv-2mhv.md) `GHSA-q339-8rmv-2mhv`, `CVE-2026-41316` · RubyGems `erb`: affected `<4.0.3.1 || >=4.0.4, <4.0.4.1 || >=5.0.0, <6.0.1.1 || >=6.0.2, <6.0.4`, fixed in `4.0.3.1`, `4.0.4.1`, `6.0.1.1`, `6.0.4` · CVSS 8.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: Insecure deserialization, CWE-693 - [Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-f786-9c63-8xr8.md) `GHSA-f786-9c63-8xr8`, `CVE-2025-62233` · Maven `org.apache.dolphinscheduler:dolphinscheduler` and 1 more: affected `>=3.2.0, <3.3.1`, fixed in `3.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Insecure deserialization - [Microsoft Bing Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-33819.md) `CVE-2026-33819` · CVE record: Microsoft Microsoft Bing · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Insecure deserialization - [KTransformers Unsafe Deserialization RCE via balance_serve](https://agentprime.io/advisories/CVE-2026-26210.md) `CVE-2026-26210` · CVE record: kvcache-ai ktransformers · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Insecure deserialization - [LeRobot Unsafe Deserialization Remote Code Execution via gRPC](https://agentprime.io/advisories/CVE-2026-25874.md) `CVE-2026-25874` · CVE record: Hugging Face LeRobot · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 23 Apr 2026 · Tags: Insecure deserialization - [camel-infinispan Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-xfxp-ppx7-cqrp.md) `GHSA-xfxp-ppx7-cqrp`, `CVE-2026-6857` · Maven `org.apache.camel:camel-infinispan`: affected `<4.20.0`, fixed in `4.20.0` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: Insecure deserialization - [Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-6023.md) `CVE-2026-6023` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 8.1 High · Not analysed yet · Published 22 Apr 2026 · Tags: Insecure deserialization - [Information disclosure in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-22016.md) `CVE-2026-22016` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure, Insecure deserialization, XML external entities (XXE) - [OpenMage LTS: Phar Deserialization leads to Remote Code Execution](https://agentprime.io/advisories/GHSA-fg79-cr9c-7369.md) `GHSA-fg79-cr9c-7369`, `CVE-2026-25524`, `PKSA-w28m-jx16-bpbn` · Packagist `openmage/magento-lts`: affected `<20.17.0`, fixed in `20.17.0` · CVSS 8.1 High · Not analysed yet · Published 21 Apr 2026 · Tags: Insecure deserialization - [WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39467.md) `CVE-2026-39467` · CVE record: MetaSlider Responsive Slider by MetaSlider · CVSS 7.2 High · Not analysed yet · Published 21 Apr 2026 · Tags: Insecure deserialization - [Apache Airflow allows code execution through crafted XCom payloads](https://agentprime.io/advisories/GHSA-6ffj-2wg2-w45j.md) `GHSA-6ffj-2wg2-w45j`, `BIT-airflow-2026-25917`, `CVE-2026-25917`, `PYSEC-2026-13`, `PYSEC-2026-2359` · PyPI `apache-airflow-core`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 7.2 High · Not analysed yet · Published 18 Apr 2026 · Tags: Insecure deserialization - [Firebird has a buffer overflow when parsing corrupted slice packets](https://agentprime.io/advisories/CVE-2026-33337.md) `CVE-2026-33337` · CVE record: FirebirdSQL firebird · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2026 · Tags: Memory corruption, Insecure deserialization - [DataEase: Quartz Deserialization → Remote Code Execution](https://agentprime.io/advisories/CVE-2026-40901.md) `CVE-2026-40901` · CVE record: dataease dataease · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: Insecure deserialization - [KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value](https://agentprime.io/advisories/CVE-2026-5426.md) `CVE-2026-5426` · CVE record: Digital Knowledge KnowledgeDeliver · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Hard-coded credentials, Insecure deserialization - [Deserialization of untrusted data in OpenText, Inc RightFax](https://agentprime.io/advisories/CVE-2025-15610.md) `CVE-2025-15610` · CVE record: OpenText, Inc RightFax · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: Insecure deserialization - [Adobe Connect | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2026-27303.md) `CVE-2026-27303` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Insecure deserialization - [Adobe Connect | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2026-34615.md) `CVE-2026-34615` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Insecure deserialization - [Azure Monitor Agent Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32192.md) `CVE-2026-32192` · CVE record: Microsoft Azure Monitor · CVSS 7.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: Insecure deserialization - [Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32184.md) `CVE-2026-32184` · CVE record: Microsoft Microsoft HPC Pack 2019 · CVSS 7.8 High · Not analysed yet · Published 14 Apr 2026 · Tags: Insecure deserialization - [Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection](https://agentprime.io/advisories/CVE-2026-3017.md) `CVE-2026-3017` · CVE record: shapedplugin Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts · CVSS 7.2 High · Not analysed yet · Published 14 Apr 2026 · Tags: Insecure deserialization - [Pachno 1.0.6 FileCache Deserialization Remote Code Execution](https://agentprime.io/advisories/CVE-2026-40044.md) `CVE-2026-40044` · CVE record: Pachno Pachno · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization - [Keras has an untrusted deserialization vulnerability](https://agentprime.io/advisories/GHSA-4f3f-g24h-fr8m.md) `GHSA-4f3f-g24h-fr8m`, `CVE-2026-1462`, `PYSEC-2026-2547` · PyPI `keras`: affected `<3.13.2`, fixed in `3.13.2` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization - [Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly ...](https://agentprime.io/advisories/GHSA-mc4f-r875-v87w.md) `GHSA-mc4f-r875-v87w`, `BIT-airflow-2026-33858`, `CVE-2026-33858`, `PYSEC-2026-20` · PyPI `apache-airflow`: affected `>=3.1.8, <3.2.0`, fixed in `3.2.0` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization - [Apache Storm: Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-jf89-3q6q-vcgr.md) `GHSA-jf89-3q6q-vcgr`, `CVE-2026-35337` · Maven `org.apache.storm:storm-client`: affected `<2.8.6`, fixed in `2.8.6` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Samsung Open Source Escargot](https://agentprime.io/advisories/CVE-2026-25204.md) `CVE-2026-25204` · CVE record: Samsung Open Source Escargot · CVSS 6.2 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization, Memory corruption - [Next.js has a Denial of Service with Server Components](https://agentprime.io/advisories/GHSA-q4gf-8mx6-v5v3.md) `GHSA-q4gf-8mx6-v5v3`, `CVE-2026-23869` · npm `next`: affected `>=13.0.0, <15.5.15 || >=16.0.0-beta.0, <16.2.3`, fixed in `15.5.15`, `16.2.3` · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Denial of service, Insecure deserialization - [React Server Components have a Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-479c-33wc-g2pg.md) `GHSA-479c-33wc-g2pg`, `CVE-2026-23869` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.5 || >=19.1.0, <19.1.6 || >=19.2.0, <19.2.5`, fixed in `19.0.5`, `19.1.6`, `19.2.5` · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Denial of service, Insecure deserialization - [Session Cache Restore — Arbitrary Free via Deserialized Pointer](https://agentprime.io/advisories/CVE-2026-5507.md) `CVE-2026-5507` · CVE record: wolfSSL wolfSSL · CVSS 4.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Insecure deserialization - [Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection](https://agentprime.io/advisories/CVE-2026-3199.md) `CVE-2026-3199` · CVE record: Sonatype Nexus Repository · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Insecure deserialization - [Mirror-registry: remote code execution using pickle deserialization](https://agentprime.io/advisories/CVE-2026-32590.md) `CVE-2026-32590` · CVE record: Red Hat mirror registry for Red Hat OpenShift 2.0 and 4 more · CVSS 7.1 High · Not analysed yet · Published 8 Apr 2026 · Tags: Insecure deserialization - [Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata](https://agentprime.io/advisories/CVE-2026-3296.md) `CVE-2026-3296` · CVE record: wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Insecure deserialization - [IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file](https://agentprime.io/advisories/CVE-2026-3357.md) `CVE-2026-3357` · CVE record: IBM Langflow Desktop · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2026 · Tags: Insecure deserialization - [Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization](https://agentprime.io/advisories/GHSA-33qg-7wpp-89cq.md) `GHSA-33qg-7wpp-89cq`, `CVE-2026-39324` · RubyGems `rack-session`: affected `>=2.0.0, <2.1.2`, fixed in `2.1.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Authentication bypass, Insecure deserialization, CWE-345, CWE-565 - [MONAI: Unsafe functions lead to pickle deserialization rce](https://agentprime.io/advisories/GHSA-89gg-p5r5-q6r4.md) `GHSA-89gg-p5r5-q6r4`, `CVE-2026-100846`, `PYSEC-2026-4021` · PyPI `monai`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA DALI](https://agentprime.io/advisories/CVE-2026-24156.md) `CVE-2026-24156` · CVE record: NVIDIA DALI · CVSS 7.3 High · Not analysed yet · Published 7 Apr 2026 · Tags: Insecure deserialization - [OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via \`jato.clientSession\` Deserialization in OpenAM](https://agentprime.io/advisories/GHSA-2cqq-rpvq-g5qj.md) `GHSA-2cqq-rpvq-g5qj`, `CVE-2026-33439` · Maven `org.openidentityplatform.openam:openam`: affected `<16.0.6`, fixed in `16.0.6` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Insecure deserialization - [HuggingFace Transformers allows for arbitrary code execution in the \`Trainer\` class](https://agentprime.io/advisories/GHSA-69w3-r845-3855.md) `GHSA-69w3-r845-3855`, `CVE-2026-1839`, `PYSEC-2026-2288` · PyPI `transformers`: affected `<5.0.0rc3`, fixed in `5.0.0rc3` · CVSS 6.5 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Insecure deserialization - [pytries datrie trie File datrie.pyx Trie.\_\_setstate\_\_ deserialization](https://agentprime.io/advisories/CVE-2026-5659.md) `CVE-2026-5659` · CVE record: pytries datrie · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Insecure deserialization, CWE-20 - [FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization](https://agentprime.io/advisories/CVE-2026-5536.md) `CVE-2026-5536` · CVE record: FedML-AI FedML · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Insecure deserialization, CWE-20 - [pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)](https://agentprime.io/advisories/GHSA-4744-96p5-mp2j.md) `GHSA-4744-96p5-mp2j`, `CVE-2026-35464`, `PYSEC-2026-2989` · PyPI `pyload-ng`: affected `<=0.5.0b3`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: Insecure deserialization, Broken access control - [NASA cFS Pickle pickle.load deserialization](https://agentprime.io/advisories/CVE-2026-5473.md) `CVE-2026-5473` · CVE record: NASA cFS · CVSS 2.0 Low · Not analysed yet · Published 3 Apr 2026 · Tags: Insecure deserialization, CWE-20 - [Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler](https://agentprime.io/advisories/GHSA-rxj3-rrwm-pj4r.md) `GHSA-rxj3-rrwm-pj4r`, `CVE-2026-35537`, `PKSA-wjqw-j5qy-sdfr` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 3.7 Low · Not analysed yet · Published 3 Apr 2026 · Tags: Insecure deserialization - [Kedro has Arbitrary Code Execution via Malicious Logging Configuration](https://agentprime.io/advisories/GHSA-9cqf-439c-j96r.md) `GHSA-9cqf-439c-j96r`, `CVE-2026-35171`, `PYSEC-2026-72` · PyPI `kedro`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: Code injection, Insecure deserialization - [Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in \`AbstractSettingsCollection\`](https://agentprime.io/advisories/CVE-2026-34838.md) `CVE-2026-34838` · CVE record: Intermesh groupoffice · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: Insecure deserialization - [An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.](https://agentprime.io/advisories/CVE-2026-34877.md) `CVE-2026-34877` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: Privilege escalation, Insecure deserialization - [OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2](https://agentprime.io/advisories/GHSA-whv5-4q2f-q68g.md) `GHSA-whv5-4q2f-q68g`, `CVE-2026-29782`, `PKSA-7wd8-5d3q-gt4k` · Packagist `devcode-it/openstamanager`: affected `<2.10.2`, fixed in `2.10.2` · CVSS 7.2 High · Not analysed yet · Published 1 Apr 2026 · Tags: Insecure deserialization - [Replicator deserializes untrusted user input](https://agentprime.io/advisories/GHSA-2gmp-34j9-fqjm.md) `GHSA-2gmp-34j9-fqjm`, `CVE-2026-2265` · npm `replicator`: affected `<=1.0.5`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .