# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40754.md) `CVE-2026-40754` · CVE record: Elated-Themes Roisin · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40751.md) `CVE-2026-40751` · CVE record: Mikado-Themes Ashtanga · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40739.md) `CVE-2026-40739` · CVE record: Mikado-Themes LuxeDrive · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40736.md) `CVE-2026-40736` · CVE record: Edge-Themes Laurits · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39580.md) `CVE-2026-39580` · CVE record: Select-Themes Micdrop · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39578.md) `CVE-2026-39578` · CVE record: Elated-Themes Valiance · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39577.md) `CVE-2026-39577` · CVE record: Elated-Themes Playroom · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39567.md) `CVE-2026-39567` · CVE record: Select-Themes Santé · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39557.md) `CVE-2026-39557` · CVE record: Elated-Themes NeoBeat · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39554.md) `CVE-2026-39554` · CVE record: Elated-Themes Fidalgo · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39539.md) `CVE-2026-39539` · CVE record: Edge-Themes Alloggio - Hotel Booking · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39529.md) `CVE-2026-39529` · CVE record: ThemeREX Group Elementra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39446.md) `CVE-2026-39446` · CVE record: PressLayouts Kapee · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39443.md) `CVE-2026-39443` · CVE record: PressLayouts EmallShop · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27429.md) `CVE-2026-27429` · CVE record: BoldThemes Nifty · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-12256.md) `CVE-2026-12256` · CVE record: ThemeFusion Fusion Builder · CVSS 8.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69122.md) `CVE-2025-69122` · CVE record: ThemeREX SeaFood Company · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69108.md) `CVE-2025-69108` · CVE record: ThemeREX Hot Coffee · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54194.md) `CVE-2026-54194` · CVE record: ThemeFusion Fusion Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Oracle Corporation WebLogic Server](https://agentprime.io/advisories/CVE-2026-35300.md) `CVE-2026-35300` · CVE record: Oracle Corporation WebLogic Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [Nexus Repository 3 - Remote Code Execution via License Deserialization](https://agentprime.io/advisories/CVE-2026-10748.md) `CVE-2026-10748` · CVE record: Sonatype Nexus Repository · CVSS 8.6 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2026-24228.md) `CVE-2026-24228` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc](https://agentprime.io/advisories/GHSA-grp7-v8xh-rj7h.md) `GHSA-grp7-v8xh-rj7h`, `CVE-2026-48853`, `EEF-CVE-2026-48853` · Hex `grpc`: affected `>=0.4.0, <1.0.0`, fixed in `1.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization, Denial of service - [SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component](https://agentprime.io/advisories/GHSA-7h7j-7vwp-cwfg.md) `GHSA-7h7j-7vwp-cwfg`, `CVE-2026-39006` · Maven `org.snmp4j:snmp4j-agent`: affected `<=3.8.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Path traversal, Broken access control, Insecure deserialization - [WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49781.md) `CVE-2026-49781` · CVE record: Brainstorm Force OttoKit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49770.md) `CVE-2026-49770` · CVE record: WP Travel Engine WP Travel Engine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49769.md) `CVE-2026-49769` · CVE record: Tomdever wpForo Forum · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49768.md) `CVE-2026-49768` · CVE record: Happyforms Happyforms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49765.md) `CVE-2026-49765` · CVE record: CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49763.md) `CVE-2026-49763` · CVE record: CRM Perks Integration for Contact Form 7 HubSpot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49109.md) `CVE-2026-49109` · CVE record: crm perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49106.md) `CVE-2026-49106` · CVE record: CRM Perks Integration for Contact Form 7 and Constant Contact · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49105.md) `CVE-2026-49105` · CVE record: CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49104.md) `CVE-2026-49104` · CVE record: CRM Perks Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49085.md) `CVE-2026-49085` · CVE record: CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42687.md) `CVE-2026-42687` · CVE record: EventPrime EventPrime · CVSS 8.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39532.md) `CVE-2026-39532` · CVE record: Stiofan Events Calendar for GeoDirectory · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39499.md) `CVE-2026-39499` · CVE record: Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39498.md) `CVE-2026-39498` · CVE record: Yeeaddons YayMail · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39481.md) `CVE-2026-39481` · CVE record: WP Chill Modula Image Gallery · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.87 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39478.md) `CVE-2026-39478` · CVE record: Eli Scheetz Anti-Malware Security and Brute-Force Firewall · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39474.md) `CVE-2026-39474` · CVE record: metaphorcreations Post Duplicator · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39472.md) `CVE-2026-39472` · CVE record: WP Overnight WooCommerce PDF Invoices & Packing Slips · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39471.md) `CVE-2026-39471` · CVE record: ShortPixel ShortPixel Image Optimizer · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39434.md) `CVE-2026-39434` · CVE record: WebAppick CTX Feed · CVSS 7.2 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-27333.md) `CVE-2026-27333` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 8.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27053.md) `CVE-2026-27053` · CVE record: VideoWhisper.com Broadcast Live Video · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-9691.md) `CVE-2026-9691` · CVE record: CRM Perks Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Insecure deserialization - [Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS](https://agentprime.io/advisories/CVE-2026-11860.md) `CVE-2026-11860` · CVE record: OpenSolution Quick.CMS · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Code injection, Insecure deserialization - [Comma AI Openpilot Pickle modeld.py pickle.loads deserialization](https://agentprime.io/advisories/CVE-2026-12191.md) `CVE-2026-12191` · CVE record: Comma AI Openpilot · CVSS 8.5 High · Not analysed yet · Published 14 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [TYPO3 CMS has Insecure Deserialization via Core API](https://agentprime.io/advisories/GHSA-c78m-c52x-jgwp.md) `GHSA-c78m-c52x-jgwp`, `CVE-2026-49740`, `PKSA-q3vc-jr63-rrrj` · Packagist `typo3/cms-core`: affected `<10.4.57 || >=11.0.0, <11.5.51 || >=12.0.0, <12.4.46 || >=13.0.0, <13.4.31 || >=14.0.0, <14.3.3`, fixed in `10.4.57`, `11.5.51`, `12.4.46`, `13.4.31`, `14.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Insecure deserialization - [Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl](https://agentprime.io/advisories/GHSA-qp3f-rvj8-46c8.md) `GHSA-qp3f-rvj8-46c8`, `CVE-2026-50633` · Maven `org.apache.cxf:cxf-integration-jca`: affected `>=4.2.0, <4.2.2 || <4.1.7`, fixed in `4.2.2`, `4.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory](https://agentprime.io/advisories/GHSA-93g8-qqv3-mrx8.md) `GHSA-93g8-qqv3-mrx8`, `CVE-2026-50632` · Maven `org.apache.cxf:cxf-rt-transports-jms`: affected `>=4.2.0, <4.2.2 || >=4.1.0, <4.1.7 || <3.6.12`, fixed in `4.2.2`, `4.1.7`, `3.6.12` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection](https://agentprime.io/advisories/GHSA-g628-r368-6vh7.md) `GHSA-g628-r368-6vh7`, `CVE-2025-27511` · Maven `org.geoserver.extension:gs-db2`: affected `<2.27.0`, fixed in `2.27.0` · CVSS 7.2 High · Not analysed yet · Published 11 Jun 2026 · Tags: Other injection, Insecure deserialization - [Spring for GraphQL: Unsafe Deserialization](https://agentprime.io/advisories/GHSA-px92-q6rc-6mwv.md) `GHSA-px92-q6rc-6mwv`, `CVE-2026-41699` · Maven `org.springframework.graphql:spring-graphql`: affected `>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8`, fixed in `2.0.4`, `1.4.6` · CVSS 8.1 High · Not analysed yet · Published 11 Jun 2026 · Tags: Insecure deserialization - [Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-20251.md) `CVE-2026-20251` · CVE record: Splunk Splunk Enterprise and 2 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation](https://agentprime.io/advisories/GHSA-g2xq-2v27-4rh3.md) `GHSA-g2xq-2v27-4rh3`, `BIT-jenkins-2026-53435`, `CVE-2026-53435` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection](https://agentprime.io/advisories/CVE-2026-52751.md) `CVE-2026-52751` · CVE record: nationalsecurityagency ghidra · CVSS 8.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Concrete CMS: PHP Object Injection via unserialize() calls](https://agentprime.io/advisories/GHSA-g82f-9pw7-773w.md) `GHSA-g82f-9pw7-773w`, `CVE-2026-10721`, `PKSA-bm9s-qzpp-vx3v` · Packagist `concrete5/concrete5`: affected `<9.5.2`, fixed in `9.5.2` · CVSS 8.4 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Insecure Deserialization via MITM in Layer 7 Policy Manager](https://agentprime.io/advisories/CVE-2026-11815.md) `CVE-2026-11815` · CVE record: Broadcom Layer 7 API Gateway · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .