# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59544.md)
  `CVE-2026-59544` · CVE record: Thrive Themes Coupon Thrive Quiz Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization
- [fastjson has a remote code execution (RCE) vulnerability](https://agentprime.io/advisories/GHSA-crf3-v9rr-v7hj.md)
  `GHSA-crf3-v9rr-v7hj`, `CVE-2026-16723` · Maven `com.alibaba:fastjson`: affected `>=1.2.68, <=1.2.83`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization, CWE-20
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-61246.md)
  `CVE-2026-61246` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60439.md)
  `CVE-2026-60439` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60373.md)
  `CVE-2026-60373` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60372.md)
  `CVE-2026-60372` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60369.md)
  `CVE-2026-60369` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Broken access control, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60367.md)
  `CVE-2026-60367` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Authentication bypass, Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Platform Security for Java](https://agentprime.io/advisories/CVE-2026-60366.md)
  `CVE-2026-60366` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass, Insecure deserialization
- [PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13190.md)
  `CVE-2026-13190` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Insecure deserialization
- [PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13185.md)
  `CVE-2026-13185` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-47058.md)
  `CVE-2026-47058` · CVE record: Oracle Corporation Oracle Java SE · CVSS 7.4 High · Not analysed yet · Published 21 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Tranformers4Rec](https://agentprime.io/advisories/CVE-2026-24232.md)
  `CVE-2026-24232` · CVE record: NVIDIA Tranformers4Rec · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Insecure deserialization
- [Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface](https://agentprime.io/advisories/CVE-2026-64606.md)
  `CVE-2026-64606` · CVE record: Apache Software Foundation Apache Fory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Insecure deserialization
- [Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths](https://agentprime.io/advisories/CVE-2026-64608.md)
  `CVE-2026-64608` · CVE record: Apache Software Foundation Apache Fory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Insecure deserialization, Memory corruption
- [ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ](https://agentprime.io/advisories/CVE-2026-63767.md)
  `CVE-2026-63767` · CVE record: kvcache-ai ktransformers · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Insecure deserialization
- [Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node](https://agentprime.io/advisories/CVE-2026-28220.md)
  `CVE-2026-28220` · CVE record: wazuh wazuh · CVSS 8.4 High · Not analysed yet · Published 20 Jul 2026 · Tags: Insecure deserialization
- [Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data](https://agentprime.io/advisories/GHSA-v2w2-w228-c444.md)
  `GHSA-v2w2-w228-c444`, `CVE-2026-12484`, `PYSEC-2026-3634` · PyPI `keras`: affected `<3.12.3 || >=3.13.0, <3.15.0`, fixed in `3.12.3`, `3.15.0` · CVSS 7.8 High · Not analysed yet · Published 19 Jul 2026 · Tags: Insecure deserialization
- [Disk Cache Deserialization Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-8476.md)
  `CVE-2026-8476` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2026 · Tags: Insecure deserialization
- [CVE-2026-14890](https://agentprime.io/advisories/CVE-2026-14890.md)
  `CVE-2026-14890` · CVE record: SGLang SGLang · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: Insecure deserialization
- [Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token](https://agentprime.io/advisories/CVE-2026-15008.md)
  `CVE-2026-15008` · CVE record: uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA TensorRT](https://agentprime.io/advisories/CVE-2026-24227.md)
  `CVE-2026-24227` · CVE record: NVIDIA TensorRT · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-24220.md)
  `CVE-2026-24220` · CVE record: NVIDIA TensorRT-LLM · CVSS 6.4 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-47472.md)
  `CVE-2026-47472` · CVE record: NVIDIA TensorRT-LLM · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA TensorRT-LLM](https://agentprime.io/advisories/CVE-2026-24233.md)
  `CVE-2026-24233` · CVE record: NVIDIA TensorRT-LLM · CVSS 8.4 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [.NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50649.md)
  `CVE-2026-50649` · CVE record: Microsoft .NET 8.0 runtime and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-55944.md)
  `CVE-2026-55944` · CVE record: Microsoft Microsoft Dynamics NAV 2018 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50509.md)
  `CVE-2026-50509` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Azure Active Directory Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-50652.md)
  `CVE-2026-50652` · CVE record: Microsoft Azure Active Directory and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-58644.md)
  `CVE-2026-58644` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.16 · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50522.md)
  `CVE-2026-50522` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-54118.md)
  `CVE-2026-54118` · CVE record: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR) and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-54117.md)
  `CVE-2026-54117` · CVE record: Microsoft Microsoft SQL Server 2025 (CU 6) and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-55009.md)
  `CVE-2026-55009` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field](https://agentprime.io/advisories/CVE-2026-12583.md)
  `CVE-2026-12583` · CVE record: Unknown Newsletters · CVSS 8.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)](https://agentprime.io/advisories/CVE-2026-58233.md)
  `CVE-2026-58233` · CVE record: SAP_SE SAP Change and Transport System Attach Tool (ctsattach) · CVSS 7.6 High · Not analysed yet · Published 14 Jul 2026 · Tags: Insecure deserialization
- [WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59521.md)
  `CVE-2026-59521` · CVE record: ShapedPlugin LLC Real Testimonials · CVSS 7.2 High · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59518.md)
  `CVE-2026-59518` · CVE record: wpWax Directorist · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57770.md)
  `CVE-2026-57770` · CVE record: ThemeGoods Grand Photography · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57744.md)
  `CVE-2026-57744` · CVE record: stmcan RT-Theme 18 | Extensions · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57738.md)
  `CVE-2026-57738` · CVE record: axiomthemes 777 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57724.md)
  `CVE-2026-57724` · CVE record: Themeum Kirki · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57713.md)
  `CVE-2026-57713` · CVE record: Marcus (aka @msykes) Events Manager · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-57371.md)
  `CVE-2026-57371` · CVE record: denishua WPJAM Basic · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization
- [PyOD persistence.load deserializes untrusted artifacts before validation](https://agentprime.io/advisories/GHSA-997v-r4v7-9f3g.md)
  `GHSA-997v-r4v7-9f3g`, `CVE-2026-15529`, `PYSEC-2026-3909` · PyPI `pyod`: affected `>=3.5.0, <3.6.2`, fixed in `3.6.2` · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization, CWE-20
- [AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization](https://agentprime.io/advisories/CVE-2026-15535.md)
  `CVE-2026-15535` · CVE record: AkariAsai self-rag · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization, CWE-20
- [yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization](https://agentprime.io/advisories/CVE-2026-15531.md)
  `CVE-2026-15531` · CVE record: yashbhalgat HashNeRF-pytorch · CVSS 4.8 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Insecure deserialization, CWE-20
- [Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-58281.md)
  `CVE-2026-58281` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 8.3 High · Not analysed yet · Published 11 Jul 2026 · Tags: Insecure deserialization
- [BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py](https://agentprime.io/advisories/GHSA-m8gf-v64p-gfmg.md)
  `GHSA-m8gf-v64p-gfmg`, `CVE-2026-54071`, `PYSEC-2026-2389` · PyPI `babeldoc`: affected `<0.6.3`, fixed in `0.6.3` · CVSS 7.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Dell Unisphere for PowerMax](https://agentprime.io/advisories/CVE-2026-54469.md)
  `CVE-2026-54469` · CVE record: Dell Unisphere for PowerMax · CVSS 8.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: Insecure deserialization
- [YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize](https://agentprime.io/advisories/GHSA-9369-69wj-7m2f.md)
  `GHSA-9369-69wj-7m2f`, `CVE-2026-52777`, `PKSA-24cb-kfcr-z2kg` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site request forgery (CSRF), Insecure deserialization
- [Metabase: Unsafe Deserialization of H2 Query Results](https://agentprime.io/advisories/CVE-2026-59827.md)
  `CVE-2026-59827` · CVE record: metabase metabase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Insecure deserialization
- [A bug in \`BaseSerialization.deserialize()\` allowed unrestricted \`import_string()\` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embe...](https://agentprime.io/advisories/GHSA-2943-9672-r45w.md)
  `GHSA-2943-9672-r45w`, `BIT-airflow-2026-33264`, `CVE-2026-33264`, `PYSEC-2026-2082` · PyPI `apache-airflow`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Insecure deserialization
- [Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel](https://agentprime.io/advisories/CVE-2026-43825.md)
  `CVE-2026-43825` · CVE record: Apache Software Foundation Apache OpenNLP :: Core :: ML :: LibSVM · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)](https://agentprime.io/advisories/GHSA-857v-xvh8-7hjc.md)
  `GHSA-857v-xvh8-7hjc`, `CVE-2026-46590` · Maven `org.apache.camel:camel-pqc`: affected `>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution](https://agentprime.io/advisories/GHSA-xww8-mxqw-m84w.md)
  `GHSA-xww8-mxqw-m84w`, `CVE-2026-43865` · Maven `org.apache.camel:camel-hazelcast`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel JMS deserialization filter bypass](https://agentprime.io/advisories/GHSA-f755-xp6r-8q84.md)
  `GHSA-f755-xp6r-8q84`, `CVE-2026-43866` · Maven `org.apache.camel:camel-activemq` and 5 more: affected `>=3.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.\*\* and enables DNS-based information disclosure](https://agentprime.io/advisories/GHSA-8h6p-jvhf-9hcr.md)
  `GHSA-8h6p-jvhf-9hcr`, `CVE-2026-42527` · Maven `org.apache.camel:camel-amqp` and 11 more: affected `>=4.14.0, <4.14.8 || >=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter](https://agentprime.io/advisories/GHSA-7cmx-qjh8-7v3v.md)
  `GHSA-7cmx-qjh8-7v3v`, `CVE-2026-43867` · Maven `org.apache.camel:camel-pqc`: affected `>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled](https://agentprime.io/advisories/GHSA-6qw3-4796-5984.md)
  `GHSA-6qw3-4796-5984`, `CVE-2026-40859` · Maven `org.apache.camel:camel-netty-http` and 1 more: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.20.0`, fixed in `4.14.8`, `4.18.3`, `4.20.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA3LTA2VDA5OjMwOjI4LjAwMDAwMFoiLCJHSFNBLTZxdzMtNDc5Ni01OTg0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA3LTIzVDExOjE4OjU5Ljk4NjAwMFoiLCJDVkUtMjAyNi02NTQ5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA3LTIzVDExOjE4OjU5Ljk4NjAwMFoiLCJDVkUtMjAyNi02NTQ5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.