# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66583.md)
  `CVE-2026-66583` · CVE record: WPMU DEV Forminator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization
- [LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector](https://agentprime.io/advisories/CVE-2026-76850.md)
  `CVE-2026-76850` · CVE record: InternLM lmdeploy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app](https://agentprime.io/advisories/CVE-2026-76404.md)
  `CVE-2026-76404` · CVE record: Splunk Splunk MCP Server app · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading REST API in Splunk AI Toolkit](https://agentprime.io/advisories/CVE-2026-76395.md)
  `CVE-2026-76395` · CVE record: Splunk Splunk AI Toolkit · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-44901.md)
  `CVE-2026-44901` · CVE record: wazuh wazuh · CVSS 8.4 High · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Dell Command Update (DCU)](https://agentprime.io/advisories/CVE-2026-49816.md)
  `CVE-2026-49816` · CVE record: Dell Dell Command Update (DCU) · CVSS 7.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Dell Command Update (DCU)](https://agentprime.io/advisories/CVE-2026-49817.md)
  `CVE-2026-49817` · CVE record: Dell Dell Command Update (DCU) · CVSS 7.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73389.md)
  `CVE-2026-73389` · CVE record: The4 Kalles Addons · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73364.md)
  `CVE-2026-73364` · CVE record: wpdesk Flexible Subscriptions · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization
- [SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization](https://agentprime.io/advisories/CVE-2026-75987.md)
  `CVE-2026-75987` · CVE record: SPLWare esProc · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Insecure deserialization, CWE-20
- [Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-60412.md)
  `CVE-2026-60412` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-60392.md)
  `CVE-2026-60392` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files](https://agentprime.io/advisories/GHSA-wg9g-w2j2-8pgr.md)
  `GHSA-wg9g-w2j2-8pgr`, `CVE-2026-100845`, `PYSEC-2026-4020` · PyPI `monai`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 8.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch](https://agentprime.io/advisories/GHSA-qxq5-qhx6-94qw.md)
  `GHSA-qxq5-qhx6-94qw`, `CVE-2026-100843`, `PYSEC-2026-4018` · PyPI `monai`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 8.5 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-74012.md)
  `CVE-2026-74012` · CVE record: TaxoPress TaxoPress · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-73397.md)
  `CVE-2026-73397` · CVE record: Youzify Youzify · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73380.md)
  `CVE-2026-73380` · CVE record: supsystic Popup by Supsystic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73376.md)
  `CVE-2026-73376` · CVE record: supsystic Ultimate Maps by Supsystic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73366.md)
  `CVE-2026-73366` · CVE record: supsystic Easy Google Maps · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73341.md)
  `CVE-2026-73341` · CVE record: Metagauss RegistrationMagic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66620.md)
  `CVE-2026-66620` · CVE record: Derek Herman OptionTree · CVSS 7.2 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32470.md)
  `CVE-2026-32470` · CVE record: Roxnor FundEngine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32465.md)
  `CVE-2026-32465` · CVE record: g5theme Essential Real Estate · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Insecure deserialization
- [Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service](https://agentprime.io/advisories/CVE-2026-16138.md)
  `CVE-2026-16138` · CVE record: Progress ShareFile Storage Zones Controller · CVSS 8.0 High · Not analysed yet · Published 17 Aug 2026 · Tags: Insecure deserialization
- [Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2024-13784.md)
  `CVE-2024-13784` · CVE record: reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2026 · Tags: Insecure deserialization
- [Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection](https://agentprime.io/advisories/CVE-2026-10035.md)
  `CVE-2026-10035` · CVE record: wpweaver Turnkey bbPress by WeaverTheme · CVSS 6.6 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Insecure deserialization
- [Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter](https://agentprime.io/advisories/CVE-2026-16099.md)
  `CVE-2026-16099` · CVE record: eteubert Podlove Podcast Publisher · CVSS 8.8 High · Not analysed yet · Published 16 Aug 2026 · Tags: Insecure deserialization
- [mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"](https://agentprime.io/advisories/GHSA-h84g-69h7-mw6v.md)
  `GHSA-h84g-69h7-mw6v`, `CVE-2026-55153` · Maven `com.mchange:mchange-commons-java`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 7.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Code injection, Insecure deserialization
- [AVEVA Enterprise SCADA Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2025-7639.md)
  `CVE-2025-7639` · CVE record: AVEVA AVEVA Enterprise SCADA and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Insecure deserialization
- [alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization](https://agentprime.io/advisories/CVE-2026-19826.md)
  `CVE-2026-19826` · CVE record: alldatacenter alldata · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Insecure deserialization, CWE-20
- [IBM WebSphere Application Server Liberty is affected by a denial of service](https://agentprime.io/advisories/CVE-2026-10571.md)
  `CVE-2026-10571` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 5.7 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Insecure deserialization
- [Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)](https://agentprime.io/advisories/CVE-2026-66256.md)
  `CVE-2026-66256` · CVE record: Apache Software Foundation Apache Shindig Common and 1 more · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Insecure deserialization
- [WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28176.md)
  `CVE-2026-28176` · CVE record: Booking Activities Team Booking Activities · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Insecure deserialization
- [WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28149.md)
  `CVE-2026-28149` · CVE record: miniOrange Headless Single Sign On · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Insecure deserialization
- [WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27380.md)
  `CVE-2026-27380` · CVE record: magepeopleteam Car Rental Manager · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Insecure deserialization
- [Filter expression injection via forged keyset pagination cursor in Ash](https://agentprime.io/advisories/GHSA-3gq3-9xm3-c8v3.md)
  `GHSA-3gq3-9xm3-c8v3`, `CVE-2026-67579`, `EEF-CVE-2026-67579` · Hex `ash`: affected `>=1.17.0, <3.31.3`, fixed in `3.31.3` · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: SQL injection, Insecure deserialization
- [Apache Airflow's Task SDK rebuilt a \`Callback\` object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because \`SyncCallback\` is itsel...](https://agentprime.io/advisories/GHSA-2qjv-p2gc-mjg2.md)
  `GHSA-2qjv-p2gc-mjg2`, `BIT-airflow-2026-67587`, `CVE-2026-67587`, `PYSEC-2026-3708` · PyPI `apache-airflow`: affected `>=3.3.0, <3.3.1`, fixed in `3.3.1` · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new \`awaiting_input\` task state swept by the scheduler. That sweep deserializes the task instance's \`next_kwargs\` without ...](https://agentprime.io/advisories/GHSA-q4c3-7575-55j2.md)
  `GHSA-q4c3-7575-55j2`, `BIT-airflow-2026-67260`, `CVE-2026-67260`, `PYSEC-2026-3707` · PyPI `apache-airflow`: affected `>=3.3.0, <3.3.1`, fixed in `3.3.1` · CVSS 7.3 High · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Apache Airflow's XCom \`GET /api/v2/{...}/xcomEntries/{key}?deserialize=true\` endpoint passed a string-literal payload through \`BaseXCom.deserialize_value\` without the \`\_check_forbidden_xcom_keys\` g...](https://agentprime.io/advisories/GHSA-fcmm-42r9-mmmm.md)
  `GHSA-fcmm-42r9-mmmm`, `BIT-airflow-2026-59242`, `CVE-2026-59242`, `PYSEC-2026-3992` · PyPI `apache-airflow`: affected `<3.3.1`, fixed in `3.3.1` · CVSS 5.4 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Apache Airflow's serialization layer reconstructed exception nodes by calling \`import_string()\` on a class name taken from the serialized blob and instantiating it with arguments from the same blob...](https://agentprime.io/advisories/GHSA-8prw-8m6x-8w6f.md)
  `GHSA-8prw-8m6x-8w6f`, `BIT-airflow-2026-58076`, `CVE-2026-58076`, `PYSEC-2026-3991` · PyPI `apache-airflow`: affected `>=3.3.0, <3.3.1`, fixed in `3.3.1` · CVSS 8.8 High · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization](https://agentprime.io/advisories/CVE-2026-73325.md)
  `CVE-2026-73325` · CVE record: Fujitsu Research OneCompression · CVSS 8.4 High · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Potential insecure deserialization in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-68756.md)
  `CVE-2026-68756` · CVE record: jfrog artifactory · CVSS 6.6 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in SonicWall GMS](https://agentprime.io/advisories/CVE-2026-18634.md)
  `CVE-2026-18634` · CVE record: SonicWall GMS · CVSS 8.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Lightroom Classic | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2026-48397.md)
  `CVE-2026-48397` · CVE record: Adobe Lightroom Classic · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-66808.md)
  `CVE-2026-66808` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-66805.md)
  `CVE-2026-66805` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-64901.md)
  `CVE-2026-64901` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-70321.md)
  `CVE-2026-70321` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65815.md)
  `CVE-2026-65815` · CVE record: Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65665.md)
  `CVE-2026-65665` · CVE record: Microsoft Microsoft SharePoint Server 2019 and 1 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65663.md)
  `CVE-2026-65663` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65658.md)
  `CVE-2026-65658` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft Exchange Server Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-62912.md)
  `CVE-2026-62912` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-59124.md)
  `CVE-2026-59124` · CVE record: Microsoft Microsoft HPC Pack 2019 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-63516.md)
  `CVE-2026-63516` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-63514.md)
  `CVE-2026-63514` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Intel(R) Extension for PyTorch](https://agentprime.io/advisories/CVE-2026-35502.md)
  `CVE-2026-35502` · CVE record: Intel(R) Extension for PyTorch · CVSS 4.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026](https://agentprime.io/advisories/CVE-2026-17061.md)
  `CVE-2026-17061` · CVE record: Dassault Systèmes SIMULIA Execution Engine · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller](https://agentprime.io/advisories/CVE-2026-15555.md)
  `CVE-2026-15555` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 and 4 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Insecure deserialization
- [Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs](https://agentprime.io/advisories/GHSA-gg2p-37pv-v7fq.md)
  `GHSA-gg2p-37pv-v7fq`, `CVE-2026-18948` · PyPI `feast`: affected `<0.67.0`, fixed in `0.67.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA4LTEwVDIxOjMyOjA3LjAwMDAwMFoiLCJHSFNBLWdnMnAtMzdwdi12N2ZxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA4LTIwVDEyOjA3OjE0Ljk2MzAwMFoiLCJDVkUtMjAyNi02NjY3MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA4LTIwVDEyOjA3OjE0Ljk2MzAwMFoiLCJDVkUtMjAyNi02NjY3MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.