# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset](https://agentprime.io/advisories/GHSA-j35q-v8h8-7mwq.md)
  `GHSA-j35q-v8h8-7mwq`, `CVE-2026-69659`, `EEF-CVE-2026-69659` · Hex `ash`: affected `>=1.17.0, <3.31.1`, fixed in `3.31.1` · CVSS 5.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Insecure deserialization
- [Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field](https://agentprime.io/advisories/CVE-2026-16267.md)
  `CVE-2026-16267` · CVE record: Unknown Newsletters · CVSS 8.1 High · Not analysed yet · Published 8 Aug 2026 · Tags: Insecure deserialization
- [ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer](https://agentprime.io/advisories/CVE-2026-68772.md)
  `CVE-2026-68772` · CVE record: ZenML ZenML · CVSS 8.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Insecure deserialization
- [Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata](https://agentprime.io/advisories/CVE-2026-71559.md)
  `CVE-2026-71559` · CVE record: Apache Software Foundation Apache Fory · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Insecure deserialization
- [Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization](https://agentprime.io/advisories/CVE-2026-71558.md)
  `CVE-2026-71558` · CVE record: Apache Software Foundation Apache Fory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Insecure deserialization
- [Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path](https://agentprime.io/advisories/CVE-2026-71560.md)
  `CVE-2026-71560` · CVE record: Apache Software Foundation Apache Fory · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Insecure deserialization
- [Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint](https://agentprime.io/advisories/CVE-2026-16258.md)
  `CVE-2026-16258` · CVE record: Unknown Ajax Search Lite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Insecure deserialization
- [Azure Service Bus Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50515.md)
  `CVE-2026-50515` · CVE record: Microsoft Azure Service Bus · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65581.md)
  `CVE-2026-65581` · CVE record: Axiomthemes AI ANN · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65579.md)
  `CVE-2026-65579` · CVE record: axiomthemes Agricola · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65578.md)
  `CVE-2026-65578` · CVE record: AncoraThemes Agora · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65577.md)
  `CVE-2026-65577` · CVE record: AncoraThemes Advice · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65576.md)
  `CVE-2026-65576` · CVE record: AncoraThemes Adrena · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65575.md)
  `CVE-2026-65575` · CVE record: AncoraThemes Accalia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65574.md)
  `CVE-2026-65574` · CVE record: AncoraThemes Abogado · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65573.md)
  `CVE-2026-65573` · CVE record: ThemeREX Abelle · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65572.md)
  `CVE-2026-65572` · CVE record: Axiomthemes A.Williams · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65571.md)
  `CVE-2026-65571` · CVE record: Axiomthemes 69 Clothing · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65556.md)
  `CVE-2026-65556` · CVE record: MihChe WPBruiser {no- Captcha anti-Spam} · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65552.md)
  `CVE-2026-65552` · CVE record: qstudio Export User Data · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65549.md)
  `CVE-2026-65549` · CVE record: jegtheme Jeg Kit for Elementor · CVSS 7.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28139.md)
  `CVE-2026-28139` · CVE record: wpdreams Ajax Search Lite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage](https://agentprime.io/advisories/CVE-2026-66909.md)
  `CVE-2026-66909` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Jenkins and others](https://agentprime.io/advisories/CVE-2026-70426.md)
  `CVE-2026-70426` · CVE record: Jenkins Project Jenkins and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Insecure deserialization
- [Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions](https://agentprime.io/advisories/CVE-2026-71294.md)
  `CVE-2026-71294` · CVE record: Cotonti Cotonti · CVSS 7.7 High · Not analysed yet · Published 5 Aug 2026 · Tags: Insecure deserialization
- [peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules](https://agentprime.io/advisories/CVE-2026-71281.md)
  `CVE-2026-71281` · CVE record: huggingface peft · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2026 · Tags: Insecure deserialization
- [Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS](https://agentprime.io/advisories/CVE-2026-61484.md)
  `CVE-2026-61484` · CVE record: Apache Software Foundation Apache Lucy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Insecure deserialization
- [MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie](https://agentprime.io/advisories/CVE-2026-70554.md)
  `CVE-2026-70554` · CVE record: MaxSite MaxSite CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47623.md)
  `CVE-2026-47623` · CVE record: NVIDIA Dynamo · CVSS 8.2 High · Not analysed yet · Published 4 Aug 2026 · Tags: Insecure deserialization
- [kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-69098.md)
  `CVE-2026-69098` · CVE record: Cinnamon kotaemon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2026 · Tags: Insecure deserialization
- [Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock](https://agentprime.io/advisories/CVE-2026-18642.md)
  `CVE-2026-18642` · CVE record: TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock · CVSS 7.8 High · Not analysed yet · Published 3 Aug 2026 · Tags: Insecure deserialization
- [Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import](https://agentprime.io/advisories/CVE-2026-16297.md)
  `CVE-2026-16297` · CVE record: Unknown Clearfy Cache · CVSS 4.1 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Insecure deserialization
- [Chama < 1.0.13 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2025-15672.md)
  `CVE-2025-15672` · CVE record: Unknown ChamaWP · CVSS 8.1 High · Not analysed yet · Published 3 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Canon Production Printing PRISMAproduction](https://agentprime.io/advisories/CVE-2026-3245.md)
  `CVE-2026-3245` · CVE record: Canon Production Printing PRISMAproduction · CVSS 7.7 High · Not analysed yet · Published 2 Aug 2026 · Tags: Insecure deserialization
- [Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content](https://agentprime.io/advisories/CVE-2026-16062.md)
  `CVE-2026-16062` · CVE record: Unknown Event Booking Manager for WooCommerce · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2026 · Tags: Insecure deserialization
- [ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-68771.md)
  `CVE-2026-68771` · CVE record: Comfy-Org ComfyUI · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: Insecure deserialization
- [Kirki < 6.0.13 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-12720.md)
  `CVE-2026-12720` · CVE record: Unknown Kirki · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server is affected by a remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-11536.md)
  `CVE-2026-11536` · CVE record: IBM WebSphere Application Server · CVSS 8.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [CVE-2026-15969](https://agentprime.io/advisories/CVE-2026-15969.md)
  `CVE-2026-15969` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [CVE-2026-15976](https://agentprime.io/advisories/CVE-2026-15976.md)
  `CVE-2026-15976` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-12118.md)
  `CVE-2026-12118` · CVE record: IBM webMethods Integration (on prem) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()](https://agentprime.io/advisories/CVE-2026-57859.md)
  `CVE-2026-57859` · CVE record: e107inc e107 · CVSS 7.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data](https://agentprime.io/advisories/CVE-2026-1360.md)
  `CVE-2026-1360` · CVE record: buddypress BuddyPress · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Insecure deserialization
- [Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0](https://agentprime.io/advisories/CVE-2026-65883.md)
  `CVE-2026-65883` · CVE record: aimy-extensions.com Aimy Captcha-Less Form Guard plugin for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: Insecure deserialization
- [Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server](https://agentprime.io/advisories/CVE-2026-58163.md)
  `CVE-2026-58163` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.3 High · Not analysed yet · Published 29 Jul 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information](https://agentprime.io/advisories/CVE-2026-14512.md)
  `CVE-2026-14512` · CVE record: IBM WebSphere Application Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities](https://agentprime.io/advisories/CVE-2026-14974.md)
  `CVE-2026-14974` · CVE record: IBM WebSphere Application Server · CVSS 8.1 High · Not analysed yet · Published 28 Jul 2026 · Tags: Insecure deserialization
- [Apache Axis2/Java: deserialization of untrusted Data](https://agentprime.io/advisories/CVE-2026-66713.md)
  `CVE-2026-66713` · CVE record: Apache Software Foundation Apache Axis2/Java · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x](https://agentprime.io/advisories/CVE-2026-11756.md)
  `CVE-2026-11756` · CVE record: Dassault Systèmes Station Launcher App in 3DEXPERIENCE platform · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Insecure deserialization
- [Potential remote code execution on an Artifactory package service container.](https://agentprime.io/advisories/CVE-2026-65617.md)
  `CVE-2026-65617` · CVE record: jfrog artifactory · CVSS 8.8 High · Not analysed yet · Published 27 Jul 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-63077.md)
  `CVE-2026-63077` · CVE record: JetBrains TeamCity · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.95 · Not analysed yet · Published 27 Jul 2026 · Tags: Insecure deserialization
- [Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field](https://agentprime.io/advisories/CVE-2026-15962.md)
  `CVE-2026-15962` · CVE record: techjewel Fluent Forms Pro Add On Pack · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2026 · Tags: Insecure deserialization
- [OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass](https://agentprime.io/advisories/GHSA-gf8h-gq53-288j.md)
  `GHSA-gf8h-gq53-288j`, `CVE-2026-62263` · Maven `org.openidentityplatform.openam:openam-auth-webauthn`: affected `<16.1.2`, fixed in `16.1.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Insecure deserialization
- [seroval: \`seroval.fromJSON()\` Promise resolver type confusion invokes attacker-controlled methods during deserialization](https://agentprime.io/advisories/GHSA-mv8w-475r-vwqw.md)
  `GHSA-mv8w-475r-vwqw`, `CVE-2026-59940` · npm `seroval`: affected `<1.5.3`, fixed in `1.5.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Insecure deserialization, Memory corruption
- [Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)](https://agentprime.io/advisories/GHSA-hhrp-gw25-jr43.md)
  `GHSA-hhrp-gw25-jr43`, `CVE-2026-57516`, `PYSEC-2026-2273` · PyPI `ray`: affected `<2.56.0`, fixed in `2.56.0` · CVSS 8.6 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection, Insecure deserialization
- [Microsoft M365 Copilot Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50517.md)
  `CVE-2026-50517` · CVE record: Microsoft Microsoft 365 Copilot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Insecure deserialization
- [C-CURE 9000 and Victor application server - Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-21655.md)
  `CVE-2026-21655` · CVE record: Johnson Control victor and 2 more · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization
- [c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets](https://agentprime.io/advisories/GHSA-w6w4-rjh9-9r58.md)
  `GHSA-w6w4-rjh9-9r58`, `CVE-2026-55223` · Maven `com.mchange:c3p0`: affected `<0.14.0`, fixed in `0.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization, Broken access control
- [WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65497.md)
  `CVE-2026-65497` · CVE record: Complianz Complianz · CVSS 7.2 High · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization
- [WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65493.md)
  `CVE-2026-65493` · CVE record: Dokan Dokan Pro · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA3LTIzVDExOjE4OjU5Ljk4NjAwMFoiLCJDVkUtMjAyNi02NTQ5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA4LTEwVDIxOjMyOjA3LjAwMDAwMFoiLCJHSFNBLWdnMnAtMzdwdi12N2ZxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA4LTEwVDIxOjMyOjA3LjAwMDAwMFoiLCJHSFNBLWdnMnAtMzdwdi12N2ZxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.