# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [AD-Security AD_Miner Cache analyse_cache.py request_a deserialization](https://agentprime.io/advisories/CVE-2026-14723.md) `CVE-2026-14723` · CVE record: AD-Security AD_Miner · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Insecure deserialization, CWE-20 - [kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization](https://agentprime.io/advisories/CVE-2026-14637.md) `CVE-2026-14637` · CVE record: kirilkirkov Ecommerce-CodeIgniter-Bootstrap · CVSS 8.8 High · Not analysed yet · Published 4 Jul 2026 · Tags: Insecure deserialization, CWE-20 - [Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules \_posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because ...](https://agentprime.io/advisories/GHSA-m6fh-58r7-x697.md) `GHSA-m6fh-58r7-x697`, `CVE-2026-14534`, `PYSEC-2026-2149` · PyPI `fickling`: affected `<0.1.11`, fixed in `0.1.11` · CVSS 8.8 High · Not analysed yet · Published 4 Jul 2026 · Tags: Insecure deserialization, CWE-184 - [Keras: Lambda deserialization can bypass safe mode and execute code](https://agentprime.io/advisories/GHSA-5gwj-m78q-7pq3.md) `GHSA-5gwj-m78q-7pq3`, `CVE-2026-12481`, `PYSEC-2026-3631` · PyPI `keras`: affected `<3.12.3 || >=3.13.0, <3.15.0`, fixed in `3.12.3`, `3.15.0` · CVSS 8.8 High · Not analysed yet · Published 3 Jul 2026 · Tags: Insecure deserialization - [WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization](https://agentprime.io/advisories/CVE-2026-13371.md) `CVE-2026-13371` · CVE record: WatchGuard Fireware OS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56037.md) `CVE-2026-56037` · CVE record: Themify Themify Popup · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57677.md) `CVE-2026-57677` · CVE record: Novalnet Novalnet Payment Gateway for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57621.md) `CVE-2026-57621` · CVE record: Arraytics Booktics · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27414.md) `CVE-2026-27414` · CVE record: Fuelthemes Werkstatt · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27060.md) `CVE-2026-27060` · CVE record: Repute Infosystems ARMember Premium · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: Insecure deserialization - [RCE via Deserialization in AWS Advanced JDBC Wrapper](https://agentprime.io/advisories/CVE-2026-14265.md) `CVE-2026-14265` · CVE record: AWS AWS Advanced JDBC Wrapper · CVSS 7.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Remote Code Execution via Unsafe Deserialization in LogItem Import](https://agentprime.io/advisories/CVE-2026-58025.md) `CVE-2026-58025` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection, Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24251.md) `CVE-2026-24251` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24250.md) `CVE-2026-24250` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24247.md) `CVE-2026-24247` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24245.md) `CVE-2026-24245` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24244.md) `CVE-2026-24244` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24243.md) `CVE-2026-24243` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA Megatron-Bridge](https://agentprime.io/advisories/CVE-2026-24240.md) `CVE-2026-24240` · CVE record: NVIDIA Megatron-Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service](https://agentprime.io/advisories/CVE-2026-58127.md) `CVE-2026-58127` · CVE record: Hyland PACSgear MediaWriter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Authentication bypass, Insecure deserialization - [PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service](https://agentprime.io/advisories/CVE-2026-58126.md) `CVE-2026-58126` · CVE record: Hyland PACSgear PACS Scan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Authentication bypass, Insecure deserialization - [Improper deserialization handling in Control-M Components](https://agentprime.io/advisories/CVE-2026-10538.md) `CVE-2026-10538` · CVE record: BMC Control-M/Enterprise Manager and 1 more · CVSS 8.9 High · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary cod…](https://agentprime.io/advisories/CVE-2026-51947.md) `CVE-2026-51947` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Insecure deserialization - [IBM WebSphere eXtreme Scale is affected by Insecure Deserilization](https://agentprime.io/advisories/CVE-2026-13759.md) `CVE-2026-13759` · CVE record: IBM WebSphere Extreme Scale · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Insecure deserialization - [Insecure Deserialization in Redis Cache Backend](https://agentprime.io/advisories/CVE-2026-7871.md) `CVE-2026-7871` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Insecure deserialization - [DTMSoft - Deserialization of Untrusted Data Vulnerability](https://agentprime.io/advisories/CVE-2026-12578.md) `CVE-2026-12578` · CVE record: deltaww DTMSoft · CVSS 8.4 High · Not analysed yet · Published 30 Jun 2026 · Tags: Insecure deserialization - [Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field](https://agentprime.io/advisories/CVE-2026-12240.md) `CVE-2026-12240` · CVE record: qlstudio Export User Data · CVSS 8.0 High · Not analysed yet · Published 30 Jun 2026 · Tags: Insecure deserialization - [SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket](https://agentprime.io/advisories/GHSA-gwv6-pq6m-p3rq.md) `GHSA-gwv6-pq6m-p3rq`, `CVE-2026-7301`, `PYSEC-2026-536` · PyPI `sglang`: affected `>=0.5.5, <=0.5.12`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [SGLang: Unauthenticated RCE via --enable-custom-logit-processor](https://agentprime.io/advisories/GHSA-36m8-w8qf-g76p.md) `GHSA-36m8-w8qf-g76p`, `CVE-2026-7304`, `PYSEC-2026-535` · PyPI `sglang`: affected `>=0.4.1.post7, <=0.5.12`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub](https://agentprime.io/advisories/GHSA-pq2f-x424-6fjm.md) `GHSA-pq2f-x424-6fjm`, `CVE-2026-31239`, `PYSEC-2026-406` · PyPI `mamba-ssm`: affected `<=2.2.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Ludwig framework is vulnerable to insecure deserialization through its predict() method.](https://agentprime.io/advisories/GHSA-wcr3-gm9f-f87q.md) `GHSA-wcr3-gm9f-f87q`, `CVE-2026-31237`, `PYSEC-2026-404` · PyPI `ludwig`: affected `<=0.10.4`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Ludwig framework is vulnerable to insecure deserialization in its model serving component](https://agentprime.io/advisories/GHSA-xp5q-5q7g-q26r.md) `GHSA-xp5q-5q7g-q26r`, `CVE-2026-31238`, `PYSEC-2026-405` · PyPI `ludwig`: affected `<=0.10.4`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading](https://agentprime.io/advisories/GHSA-32vr-5gcf-3pw2.md) `GHSA-32vr-5gcf-3pw2`, `CVE-2026-39890`, `PYSEC-2026-462` · PyPI `praisonai`: affected `<4.5.115`, fixed in `4.5.115` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer](https://agentprime.io/advisories/GHSA-c2jg-5cp7-6wc7.md) `GHSA-c2jg-5cp7-6wc7`, `CVE-2025-62373`, `PYSEC-2026-458` · PyPI `pipecat-ai`: affected `>=0.0.41, <0.0.94`, fixed in `0.0.94` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker](https://agentprime.io/advisories/GHSA-3cp7-c6q2-94xr.md) `GHSA-3cp7-c6q2-94xr`, `CVE-2026-3059`, `GHSA-rgq9-fqf5-fv58`, `PYSEC-2026-539` · PyPI `sglang`: affected `<0.5.10`, fixed in `0.5.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module](https://agentprime.io/advisories/GHSA-jx93-g359-86wm.md) `GHSA-jx93-g359-86wm`, `CVE-2026-3060`, `PYSEC-2026-537` · PyPI `sglang`: affected `<0.5.10`, fixed in `0.5.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in synthcity](https://agentprime.io/advisories/GHSA-4957-7vhp-7v59.md) `GHSA-4957-7vhp-7v59`, `CVE-2024-0937`, `PYSEC-2026-547` · PyPI `synthcity`: affected `<=0.2.9`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE](https://agentprime.io/advisories/GHSA-q9r5-6hrr-9ph7.md) `GHSA-q9r5-6hrr-9ph7`, `CVE-2025-14931`, `PYSEC-2026-543` · PyPI `smolagents`: affected `<=1.23.0`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Rasa Allows Remote Code Execution via Remote Model Loading](https://agentprime.io/advisories/GHSA-cpv4-ggrr-7j9v.md) `GHSA-cpv4-ggrr-7j9v`, `CVE-2024-49375`, `PYSEC-2026-513`, `PYSEC-2026-514` · PyPI `rasa`: affected `<3.6.21`, fixed in `3.6.21` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Code injection, Insecure deserialization - [pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer](https://agentprime.io/advisories/GHSA-f74j-gffq-vm9p.md) `GHSA-f74j-gffq-vm9p`, `CVE-2025-62515`, `PYSEC-2026-503` · PyPI `pyquokka`: affected `<=0.3.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Apache Pyfory python is vulnerable to deserialization of untrusted data](https://agentprime.io/advisories/GHSA-538v-3wq9-4h3r.md) `GHSA-538v-3wq9-4h3r`, `CVE-2025-61622`, `PYSEC-2026-490`, `PYSEC-2026-491` · PyPI `pyfury`: affected `>=0.1.0, <=0.10.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.49 · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [Qiskit allows arbitrary code execution decoding QPY format versions < 13](https://agentprime.io/advisories/GHSA-6m2c-76ff-6vrf.md) `GHSA-6m2c-76ff-6vrf`, `CVE-2025-2000`, `PYSEC-2026-510`, `PYSEC-2026-511` · PyPI `qiskit`: affected `<1.4.2 || >=2.0.0rc1, <2.0.0rc2`, fixed in `1.4.2`, `2.0.0rc2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Insecure deserialization - [PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)](https://agentprime.io/advisories/GHSA-2fmj-p74r-3wjm.md) `GHSA-2fmj-p74r-3wjm`, `CVE-2026-49286`, `PKSA-xz12-xgjc-r2wn` · Packagist `pontedilana/php-weasyprint`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.1 High · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET_KEY_BASE=OVERWRITE_ME\` and \`cookies_serializer = :marshal\`](https://agentprime.io/advisories/CVE-2026-46386.md) `CVE-2026-46386` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization, Hard-coded credentials, CWE-1188, CWE-1392 - [JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution](https://agentprime.io/advisories/GHSA-r937-wjx7-w2jp.md) `GHSA-r937-wjx7-w2jp`, `CVE-2026-53914` · Maven `org.jetbrains.kotlin:kotlin-gradle-plugin`: affected `<2.4.20-Beta1`, fixed in `2.4.20-Beta1` · CVSS 6.7 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56057.md) `CVE-2026-56057` · CVE record: Uncanny Owl Uncanny Automator Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56055.md) `CVE-2026-56055` · CVE record: InspiryThemes RealHomes · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56032.md) `CVE-2026-56032` · CVE record: BuddyBoss Buddyboss Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56031.md) `CVE-2026-56031` · CVE record: Uncanny Owl Uncanny Automator · CVSS 8.1 High · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()](https://agentprime.io/advisories/CVE-2026-57527.md) `CVE-2026-57527` · CVE record: zaproxy zap-extensions · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode](https://agentprime.io/advisories/GHSA-mq7r-vm99-p7vx.md) `GHSA-mq7r-vm99-p7vx` · PyPI `picklescan`: affected `<0.0.30`, fixed in `0.0.30` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization - [MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments](https://agentprime.io/advisories/GHSA-qhmf-xw27-6rqr.md) `GHSA-qhmf-xw27-6rqr`, `CVE-2026-48517` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Code injection, Insecure deserialization - [MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows](https://agentprime.io/advisories/GHSA-382j-8mxh-c7x2.md) `GHSA-382j-8mxh-c7x2`, `CVE-2026-48502` · NuGet `MessagePack`: affected `>=3.0, <3.1.7`, fixed in `3.1.7` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption, Denial of service, Code injection, Insecure deserialization - [amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()](https://agentprime.io/advisories/GHSA-g697-2xrc-gc46.md) `GHSA-g697-2xrc-gc46`, `CVE-2026-9291`, `PYSEC-2026-2342` · PyPI `amazon-braket-sdk`: affected `>=1.10.0, <1.117.0`, fixed in `1.117.0` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Insecure deserialization - [LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading](https://agentprime.io/advisories/GHSA-fjqc-hq36-qh5p.md) `GHSA-fjqc-hq36-qh5p`, `CVE-2026-48775`, `PYSEC-2026-2573` · PyPI `langgraph-checkpoint`: affected `<4.1.1`, fixed in `4.1.1` · CVSS 6.8 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Insecure deserialization, CWE-913 - [OpenAM has Unsafe Java Deserialization via SNS](https://agentprime.io/advisories/GHSA-pp89-732f-3g8q.md) `GHSA-pp89-732f-3g8q`, `CVE-2026-45794` · Maven `org.openidentityplatform.openam:openam-push-notification`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: Insecure deserialization - [WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-56053.md) `CVE-2026-56053` · CVE record: EventPrime EventPrime · CVSS 8.8 High · Not analysed yet · Published 25 Jun 2026 · Tags: Insecure deserialization - [MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-10043.md) `CVE-2026-10043` · CVE record: MosaicML Composer · CVSS 7.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: Insecure deserialization - [Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto](https://agentprime.io/advisories/GHSA-q63x-9pfm-mjx4.md) `GHSA-q63x-9pfm-mjx4`, `CVE-2026-56121` · PyPI `feast`: affected `<0.63.0`, fixed in `0.63.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Insecure deserialization - [OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage](https://agentprime.io/advisories/GHSA-6c99-87fr-6q7r.md) `GHSA-6c99-87fr-6q7r`, `CVE-2026-45051` · Maven `org.openidentityplatform.openam:openam-auth-webauthn`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .