# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist](https://agentprime.io/advisories/GHSA-85qj-f5wg-rwp9.md) `GHSA-85qj-f5wg-rwp9`, `CVE-2026-41862` · Maven `org.springframework.statemachine:spring-statemachine-kryo`: affected `>=3.2.0, <=3.2.4 || >=4.0.0, <4.0.2`, fixed in `4.0.2` · CVSS 8.8 High · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation](https://agentprime.io/advisories/GHSA-j3rv-43j4-c7qm.md) `GHSA-j3rv-43j4-c7qm`, `CVE-2026-54512` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.10.0, <2.18.8 || >=3.0.0, <3.1.4 || >=2.19.0, <2.21.4`, fixed in `2.18.8`, `3.1.4`, `2.21.4` · CVSS 8.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization, CWE-184 - [Duplicate Advisory: Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval](https://agentprime.io/advisories/GHSA-x36p-c636-788x.md) `GHSA-x36p-c636-788x` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper](https://agentprime.io/advisories/GHSA-q8qp-8jq6-78mc.md) `GHSA-q8qp-8jq6-78mc` · PyPI `picklescan`: affected `<0.0.28`, fixed in `0.0.28` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan has a missing detection when calling built-in python profile.Profile.runctx](https://agentprime.io/advisories/GHSA-mg57-j93w-g3c7.md) `GHSA-mg57-j93w-g3c7` · PyPI `picklescan`: affected `<0.0.29`, fixed in `0.0.29` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions](https://agentprime.io/advisories/GHSA-gq8p-2329-gh3x.md) `GHSA-gq8p-2329-gh3x` · PyPI `picklescan`: affected `<0.0.29`, fixed in `0.0.29` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.](https://agentprime.io/advisories/CVE-2026-39253.md) `CVE-2026-39253` · CVE record · CVSS 8.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-9837-48hr-q32j.md) `GHSA-9837-48hr-q32j`, `CVE-2026-46607`, `PYSEC-2026-2496` · PyPI `glances`: affected `<4.5.5`, fixed in `4.5.5` · CVSS 7.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Insecure deserialization - [OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI](https://agentprime.io/advisories/GHSA-43x2-g84q-fmqx.md) `GHSA-43x2-g84q-fmqx`, `CVE-2026-46495` · Maven `org.openidentityplatform.opendj:opendj-server-legacy`: affected `<5.1.1`, fixed in `5.1.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Insecure deserialization - [Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types](https://agentprime.io/advisories/GHSA-c8q4-9h32-2ww8.md) `GHSA-c8q4-9h32-2ww8`, `CVE-2026-44795` · Maven `io.spinnaker.orca:orca-core` and 1 more: affected `<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3`, fixed in `2025.3.3`, `2025.4.4`, `2026.0.3` · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection, Insecure deserialization - [Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils.\_config_module.load_config](https://agentprime.io/advisories/GHSA-qvp4-q2p5-22gg.md) `GHSA-qvp4-q2p5-22gg` · PyPI `picklescan`: affected `<0.0.28`, fixed in `0.0.28` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 21 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx](https://agentprime.io/advisories/GHSA-fcqg-3mwf-cfcf.md) `GHSA-fcqg-3mwf-cfcf` · PyPI `picklescan`: affected `<0.0.30`, fixed in `0.0.30` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 21 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand](https://agentprime.io/advisories/GHSA-8mc5-7w9m-fqv6.md) `GHSA-8mc5-7w9m-fqv6` · PyPI `picklescan`: affected `<0.0.30`, fixed in `0.0.30` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 21 Jun 2026 · Tags: Insecure deserialization - [zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization](https://agentprime.io/advisories/CVE-2026-12787.md) `CVE-2026-12787` · CVE record: zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 · CVSS 5.3 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4](https://agentprime.io/advisories/CVE-2026-48909.md) `CVE-2026-48909` · CVE record: joomshaper.net SP LMS extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jun 2026 · Tags: Insecure deserialization - [VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files](https://agentprime.io/advisories/GHSA-rpj2-4hq8-938g.md) `GHSA-rpj2-4hq8-938g` · PyPI `vcrpy`: affected `<8.2.1`, fixed in `8.2.1` · CVSS 7.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: Insecure deserialization - [Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders](https://agentprime.io/advisories/GHSA-v5jw-96jm-7h2c.md) `GHSA-v5jw-96jm-7h2c`, `CVE-2026-54499`, `PYSEC-2026-3075` · PyPI `stanza`: affected `<1.12.2`, fixed in `1.12.2` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Insecure deserialization, CWE-676 - [pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution](https://agentprime.io/advisories/CVE-2026-12046.md) `CVE-2026-12046` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, Insecure deserialization - [Deserialization vulnerability in ibaPDA and ibaDatCoordinator](https://agentprime.io/advisories/CVE-2026-8024.md) `CVE-2026-8024` · CVE record: iba ibaPDA and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Insecure deserialization - [Remote Code Execution (RCE) vulnerability in Windchill PDMlink](https://agentprime.io/advisories/CVE-2026-12569.md) `CVE-2026-12569` · CVE record: PTC Windchill PDMLink and 1 more · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.46 · Not analysed yet · Published 18 Jun 2026 · Tags: Insecure deserialization, CWE-20 - [Duplicate Advisory: picklescan missing detection by simple obfuscation of a \`builtins.eval\` call](https://agentprime.io/advisories/GHSA-j6c9-qvp8-699f.md) `GHSA-j6c9-qvp8-699f` · PyPI `picklescan`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing](https://agentprime.io/advisories/GHSA-rmpp-8wf5-xx5q.md) `GHSA-rmpp-8wf5-xx5q` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [NVIDIA SIL GEN3C Unauthenticated RCE via Pickle Deserialization in Inference API](https://agentprime.io/advisories/CVE-2026-53805.md) `CVE-2026-53805` · CVE record: nv-tlabs GEN3C · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60236.md) `CVE-2025-60236` · CVE record: EMV Creatify · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60231.md) `CVE-2025-60231` · CVE record: EMV The Hospital · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60230.md) `CVE-2025-60230` · CVE record: Themeton The Barber Shop · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60229.md) `CVE-2025-60229` · CVE record: Themeton Lagom · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49108.md) `CVE-2026-49108` · CVE record: park_of_ideas Moderno · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40757.md) `CVE-2026-40757` · CVE record: Mikado-Themes Château · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40756.md) `CVE-2026-40756` · CVE record: Mikado-Themes Zoya · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40752.md) `CVE-2026-40752` · CVE record: Select-Themes Manufaktur Solutions · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40738.md) `CVE-2026-40738` · CVE record: Edge-Themes Eldon · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40733.md) `CVE-2026-40733` · CVE record: Mikado-Themes ShiftUp · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39576.md) `CVE-2026-39576` · CVE record: Elated-Themes SingleMalt · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39560.md) `CVE-2026-39560` · CVE record: Select-Themes Hiroshi · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Konsept theme <= 1.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39556.md) `CVE-2026-39556` · CVE record: Elated-Themes Konsept · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39445.md) `CVE-2026-39445` · CVE record: PressLayouts Alukas · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39442.md) `CVE-2026-39442` · CVE record: PressLayouts PressMart · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69130.md) `CVE-2025-69130` · CVE record: Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69127.md) `CVE-2025-69127` · CVE record: ThemeREX Plumbing · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69111.md) `CVE-2025-69111` · CVE record: ThemeREX Reisen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation](https://agentprime.io/advisories/CVE-2026-11857.md) `CVE-2026-11857` · CVE record: Quanos Solutions GmbH SCHEMA ST4 · CVSS 8.4 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54806.md) `CVE-2026-54806` · CVE record: Melapress WP Activity Log · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-52706.md) `CVE-2026-52706` · CVE record: Jetimpex Inc. JetEngine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49107.md) `CVE-2026-49107` · CVE record: Thrive Themes Thrive Apprentice · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-49075.md) `CVE-2026-49075` · CVE record: Jetimpex Inc. JetEngine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42380.md) `CVE-2026-42380` · CVE record: jwsthemes AI Lab · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40753.md) `CVE-2026-40753` · CVE record: Mikado-Themes EasyMeals · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40735.md) `CVE-2026-40735` · CVE record: Edge-Themes Reina · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40725.md) `CVE-2026-40725` · CVE record: Barn2 Media Ltd WooCommerce Product Filters · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39573.md) `CVE-2026-39573` · CVE record: Select-Themes Mildhill · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39545.md) `CVE-2026-39545` · CVE record: Select-Themes Zermatt · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-27410.md) `CVE-2026-27410` · CVE record: VeronaLabs Slimstat Analytics · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60205.md) `CVE-2025-60205` · CVE record: ThemeREX Group ThemeREX Addons · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import](https://agentprime.io/advisories/CVE-2026-12115.md) `CVE-2026-12115` · CVE record: wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress · CVSS 6.6 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Insecure deserialization - [WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40761.md) `CVE-2026-40761` · CVE record: Edge-Themes Valeska · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40760.md) `CVE-2026-40760` · CVE record: Edge-Themes Behold · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40759.md) `CVE-2026-40759` · CVE record: Mikado-Themes Esmée · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40758.md) `CVE-2026-40758` · CVE record: Elated-Themes Léonie · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization - [WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40755.md) `CVE-2026-40755` · CVE record: Mikado-Themes TechLink · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .