# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization](https://agentprime.io/advisories/GHSA-xq69-5h5v-x9x4.md) `GHSA-xq69-5h5v-x9x4`, `CVE-2026-41731` · Maven `org.springframework.kafka:spring-kafka`: affected `>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11`, fixed in `4.0.6`, `3.3.16` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization](https://agentprime.io/advisories/GHSA-gg69-9wwp-6jx2.md) `GHSA-gg69-9wwp-6jx2`, `CVE-2026-41732` · Maven `org.springframework.pulsar:spring-pulsar`: affected `>=2.0.0, <2.0.6 || >=1.2.0, <1.2.18 || <=1.1.17`, fixed in `2.0.6`, `1.2.18` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository](https://agentprime.io/advisories/GHSA-2q7c-5gjm-7q23.md) `GHSA-2q7c-5gjm-7q23`, `CVE-2026-40993` · Maven `org.springframework.security:spring-security-saml2-service-provider`: affected `>=7.0.0, <7.0.6`, fixed in `7.0.6` · CVSS 7.3 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2026-44963.md) `CVE-2026-44963` · CVE record: Veeam Backup and Replication · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [Microsoft SharePoint Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-48560.md) `CVE-2026-48560` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [Microsoft SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-45484.md) `CVE-2026-45484` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.34 · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [Nuance PowerScribe Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-26142.md) `CVE-2026-26142` · CVE record: Microsoft Nuance PowerScribe 360 4.0 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field](https://agentprime.io/advisories/CVE-2026-8365.md) `CVE-2026-8365` · CVE record: creativethemeshq Blocksy · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [Spring Framework Unsafe Deserialization via Jackson JMS Converters](https://agentprime.io/advisories/GHSA-x863-p983-p4f7.md) `GHSA-x863-p983-p4f7`, `CVE-2026-41855` · Maven `org.springframework:spring-jms`: affected `<=5.3.39 || >=6.0.0, <=6.1.21 || >=6.2.0, <6.2.19 || >=7.0.0-M1, <7.0.8`, fixed in `6.2.19`, `7.0.8` · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization - [PHPSpreadsheet has a patch bypass for CVE-2026-34084](https://agentprime.io/advisories/GHSA-87m4-826x-3crx.md) `GHSA-87m4-826x-3crx`, `CVE-2026-45034`, `PKSA-x678-4z45-v3d5` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.5`, fixed in `1.30.5` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jun 2026 · Tags: Insecure deserialization - [LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload](https://agentprime.io/advisories/CVE-2026-7566.md) `CVE-2026-7566` · CVE record: thimpress LearnPress – Backup & Migration Tool · CVSS 6.6 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Insecure deserialization - [Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value](https://agentprime.io/advisories/CVE-2026-7654.md) `CVE-2026-7654` · CVE record: codepress Admin Columns · CVSS 8.8 High · Not analysed yet · Published 5 Jun 2026 · Tags: Insecure deserialization - [OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash](https://agentprime.io/advisories/GHSA-q3g8-rjrx-59ph.md) `GHSA-q3g8-rjrx-59ph`, `CVE-2026-50589`, `PYSEC-2026-216` · PyPI `ironic`: affected `>=32.0.0, <37.0.0`, fixed in `37.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Insecure deserialization, Denial of service - [Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path](https://agentprime.io/advisories/GHSA-8f39-v287-78jf.md) `GHSA-8f39-v287-78jf`, `CVE-2026-50076` · Maven `org.apache.fory:fory-core`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Insecure deserialization - [Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service](https://agentprime.io/advisories/CVE-2026-25551.md) `CVE-2026-25551` · CVE record: Seagull Software, LLC. BarTender 2021 · CVSS 8.5 High · Not analysed yet · Published 4 Jun 2026 · Tags: Insecure deserialization - [Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service](https://agentprime.io/advisories/CVE-2026-25550.md) `CVE-2026-25550` · CVE record: Seagull Software, LLC. BarTender 2010 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Authentication bypass, Insecure deserialization - [Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components](https://agentprime.io/advisories/GHSA-52pr-7vmf-2w7x.md) `GHSA-52pr-7vmf-2w7x`, `CVE-2026-7888`, `PKSA-93vh-t1hn-q1kn` · Packagist `concrete5/concrete5`: affected `<9.5.2`, fixed in `9.5.2` · CVSS 8.4 High · Not analysed yet · Published 3 Jun 2026 · Tags: Insecure deserialization - [React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE](https://agentprime.io/advisories/GHSA-49rj-9fvp-4h2h.md) `GHSA-49rj-9fvp-4h2h`, `CVE-2026-42211` · npm `react-router`: affected `>=7.0.0, <7.14.2`, fixed in `7.14.2` · CVSS 8.1 High · Not analysed yet · Published 3 Jun 2026 · Tags: Insecure deserialization - [AIOHTTP is Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-jg22-mg44-37j8.md) `GHSA-jg22-mg44-37j8`, `CVE-2026-34993`, `PYSEC-2026-2104` · PyPI `aiohttp`: affected `<3.14.0`, fixed in `3.14.0` · CVSS 6.4 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Insecure deserialization - [Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass](https://agentprime.io/advisories/GHSA-v3pr-hxpr-mfm8.md) `GHSA-v3pr-hxpr-mfm8`, `CVE-2026-47065` · Maven `org.apache.mina:mina-core`: affected `>=2.2.0, <2.2.8 || >=2.1.0, <2.1.13 || <2.0.29`, fixed in `2.2.8`, `2.1.13`, `2.0.29` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NVTabular](https://agentprime.io/advisories/CVE-2026-24237.md) `CVE-2026-24237` · CVE record: NVIDIA NVTabular · CVSS 7.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NVTabular](https://agentprime.io/advisories/CVE-2026-24221.md) `CVE-2026-24221` · CVE record: NVIDIA NVTabular · CVSS 7.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization - [WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39555.md) `CVE-2026-39555` · CVE record: Elated-Themes Askka · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization - [WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39551.md) `CVE-2026-39551` · CVE record: Elated-Themes Töbel · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization - [WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39550.md) `CVE-2026-39550` · CVE record: Elated-Themes Aperitif · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization - [FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()](https://agentprime.io/advisories/GHSA-3c3g-7hwg-9qmr.md) `GHSA-3c3g-7hwg-9qmr`, `CVE-2026-10566`, `PYSEC-2026-2637` · PyPI `metagpt`: affected `<=0.8.2`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [IBM WebSphere Application Server is affected by remote code execution](https://agentprime.io/advisories/CVE-2026-9330.md) `CVE-2026-9330` · CVE record: IBM WebSphere Application Server · CVSS 8.5 High · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [IBM WebSphere Application Server is affected by a remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-9319.md) `CVE-2026-9319` · CVE record: IBM WebSphere Application Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-49121.md) `CVE-2026-49121` · CVE record: ROCm aiter · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [Logback vulnerable to Object Injection through HardenedObjectInputStream modules](https://agentprime.io/advisories/GHSA-jhq6-gfmj-v8fx.md) `GHSA-jhq6-gfmj-v8fx`, `CVE-2026-10532` · Maven `ch.qos.logback:logback-core`: affected `<1.5.34`, fixed in `1.5.34` · CVSS 2.9 Low · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [Apache Airflow Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-2r5m-76wx-56gx.md) `GHSA-2r5m-76wx-56gx`, `BIT-airflow-2026-45360`, `CVE-2026-45360`, `PYSEC-2026-186` · PyPI `apache-airflow`: affected `>=3.2.0, <3.2.2`, fixed in `3.2.2` · CVSS 7.3 High · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [A bug in Apache Airflow's XCom PATCH endpoint \`PATCH /api/v2/xcomEntries/{key}\` allowed an authenticated UI/API user with XCom write permission on a Dag to set XCom entries under reserved key names...](https://agentprime.io/advisories/GHSA-wr76-29cr-67w8.md) `GHSA-wr76-29cr-67w8`, `BIT-airflow-2026-42359`, `CVE-2026-42359`, `PYSEC-2026-185` · PyPI `apache-airflow`: affected `>=3.2.0, <3.2.2`, fixed in `3.2.2` · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x throu…](https://agentprime.io/advisories/CVE-2026-7858.md) `CVE-2026-7858` · CVE record: Dassault Systèmes Teamwork Cloud - Standard Edition and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files.](https://agentprime.io/advisories/CVE-2026-38950.md) `CVE-2026-38950` · CVE record · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization - [manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model](https://agentprime.io/advisories/CVE-2026-10042.md) `CVE-2026-10042` · CVE record: zyddnys manga-image-translator · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Insecure deserialization - [WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection](https://agentprime.io/advisories/CVE-2025-11993.md) `CVE-2025-11993` · CVE record: sbthemes WooCommerce Infinite Scroll and Ajax Pagination · CVSS 8.8 High · Not analysed yet · Published 29 May 2026 · Tags: Insecure deserialization - [QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability](https://agentprime.io/advisories/GHSA-p47f-322f-whfh.md) `GHSA-p47f-322f-whfh`, `CVE-2026-9828` · Maven `ch.qos.logback:logback-core`: affected `<1.5.33`, fixed in `1.5.33` · CVSS 2.9 Low · Not analysed yet · Published 28 May 2026 · Tags: Insecure deserialization - [An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java component](https://agentprime.io/advisories/CVE-2026-37579.md) `CVE-2026-37579` · CVE record · CVSS 7.3 High · Not analysed yet · Published 28 May 2026 · Tags: Insecure deserialization - [Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener](https://agentprime.io/advisories/GHSA-m7v2-7gxm-vc2v.md) `GHSA-m7v2-7gxm-vc2v`, `CVE-2026-45077`, `PKSA-13hy-qbkf-1ty7`, `PKSA-4wjj-gy1p-ft3r` · Packagist `symfony/monolog-bridge` and 1 more: affected `<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `5.4.52`, `6.4.40`, `7.4.12`, `8.0.12` · CVSS 8.3 High · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization, Information disclosure - [RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-47161.md) `CVE-2026-47161` · CVE record: inducer relate · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization - [Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction](https://agentprime.io/advisories/GHSA-36fc-7wjg-mfvj.md) `GHSA-36fc-7wjg-mfvj`, `CVE-2026-45162`, `PKSA-882j-k212-wjbf` · Packagist `pimcore/pimcore`: affected `<11.5.17 || >=12.0.0-RC1, <12.3.7 || >=2026.1.0, <2026.1.3`, fixed in `11.5.17`, `12.3.7`, `2026.1.3` · CVSS 8.0 High · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization - [Jenkins LDAP Plugin deserializes data from LDAP referrals without validation](https://agentprime.io/advisories/GHSA-x9v8-p946-5pwc.md) `GHSA-x9v8-p946-5pwc`, `CVE-2026-48917` · Maven `org.jenkins-ci.plugins:ldap`: affected `<807.809.vd3a`, fixed in `807.809.vd3a` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization - [Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation](https://agentprime.io/advisories/GHSA-p2gw-f3rv-82mw.md) `GHSA-p2gw-f3rv-82mw`, `CVE-2026-48919` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.1`, fixed in `2.41.1` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Merlin Transformers4Rec](https://agentprime.io/advisories/CVE-2026-24162.md) `CVE-2026-24162` · CVE record: NVIDIA Merlin Transformers4Rec · CVSS 7.8 High · Not analysed yet · Published 26 May 2026 · Tags: Insecure deserialization - [Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection](https://agentprime.io/advisories/CVE-2026-45247.md) `CVE-2026-45247` · CVE record: Mirasvit Full Page Cache Warmer for Magento 2 · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.26 · Not analysed yet · Published 26 May 2026 · Tags: Insecure deserialization - [TCC-TRANSACTION has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-4r4v-3jc5-hrg9.md) `GHSA-4r4v-3jc5-hrg9`, `CVE-2026-9497` · Maven `org.mengyun:tcc-transaction`: affected `<=2.1.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Insecure deserialization, CWE-20 - [HuggingFace transformers vulnerable to remote code execution](https://agentprime.io/advisories/GHSA-29pf-2h5f-8g72.md) `GHSA-29pf-2h5f-8g72`, `CVE-2026-4372`, `PYSEC-2026-2289` · PyPI `transformers`: affected `<5.3.0`, fixed in `5.3.0` · CVSS 7.8 High · Not analysed yet · Published 26 May 2026 · Tags: Insecure deserialization, CWE-1066 - [Microsoft Planetary Computer Pro Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-41104.md) `CVE-2026-41104` · CVE record: Microsoft Microsoft Planetary Computer Pro (GeoCatalog) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: Insecure deserialization - [Microsoft SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-45659.md) `CVE-2026-45659` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.80 · Not analysed yet · Published 22 May 2026 · Tags: Insecure deserialization - [Concrete CMS Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-pv2v-6w2v-97x6.md) `GHSA-pv2v-6w2v-97x6`, `CVE-2026-8135`, `PKSA-wrt6-mxyh-dqd1` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 8.9 High · Not analysed yet · Published 21 May 2026 · Tags: Insecure deserialization - [Apache Fory PyFory Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-m5gw-83w2-7749.md) `GHSA-m5gw-83w2-7749`, `CVE-2026-48207`, `PYSEC-2026-2984` · PyPI `pyfory`: affected `>=0.13.0, <1.0.0`, fixed in `1.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA BioNeMo Framework](https://agentprime.io/advisories/CVE-2026-24216.md) `CVE-2026-24216` · CVE record: NVIDIA BioNeMo Framework · CVSS 7.8 High · Not analysed yet · Published 20 May 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-24163.md) `CVE-2026-24163` · CVE record: NVIDIA TensorRT-LLM · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-24142.md) `CVE-2026-24142` · CVE record: NVIDIA TensorRT-LLM · CVSS 6.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2025-33255.md) `CVE-2025-33255` · CVE record: NVIDIA TensorRT-LLM · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Insecure deserialization - [Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie](https://agentprime.io/advisories/CVE-2026-7637.md) `CVE-2026-7637` · CVE record: PixelYourSite Boost · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 May 2026 · Tags: Insecure deserialization - [Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)](https://agentprime.io/advisories/GHSA-9wxq-mwqw-8hhg.md) `GHSA-9wxq-mwqw-8hhg`, `CVE-2026-6009` · Maven `net.sf.jasperreports:jasperreports`: affected `<7.0.7`, fixed in `7.0.7` · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: Insecure deserialization - [APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization](https://agentprime.io/advisories/GHSA-9cfw-f3f9-7mm7.md) `GHSA-9cfw-f3f9-7mm7`, `CVE-2026-31072`, `PYSEC-2026-282` · PyPI `apscheduler`: affected `>=4.0.0a1, <=4.0.0a6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Insecure deserialization - [ModelScope is vulnerable to arbitrary code injection via a crafted module](https://agentprime.io/advisories/GHSA-fhhq-h4hg-549x.md) `GHSA-fhhq-h4hg-549x`, `CVE-2025-51427`, `PYSEC-2026-2663` · PyPI `modelscope`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Code injection, Insecure deserialization - [HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal](https://agentprime.io/advisories/CVE-2026-43633.md) `CVE-2026-43633` · CVE record: hestiacp hestiacp · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .