# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61764.md)
  `CVE-2026-61764` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61765.md)
  `CVE-2026-61765` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61759.md)
  `CVE-2026-61759` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61750.md)
  `CVE-2026-61750` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61751.md)
  `CVE-2026-61751` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61752.md)
  `CVE-2026-61752` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61754.md)
  `CVE-2026-61754` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61758.md)
  `CVE-2026-61758` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61755.md)
  `CVE-2026-61755` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61756.md)
  `CVE-2026-61756` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61757.md)
  `CVE-2026-61757` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading](https://agentprime.io/advisories/CVE-2026-84202.md)
  `CVE-2026-84202` · CVE record: modelscope modelscope · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-82226.md)
  `CVE-2026-82226` · CVE record: Tickera Tickera · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Insecure deserialization
- [Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination](https://agentprime.io/advisories/CVE-2026-83497.md)
  `CVE-2026-83497` · CVE record: OpenSearch OpenSearch and 1 more · CVSS 8.7 High · Not analysed yet · Published 31 Aug 2026 · Tags: Insecure deserialization
- [Unsafe deserialization of decrypted terms enables node DoS in AshCloak](https://agentprime.io/advisories/GHSA-rc26-mrm2-6pf9.md)
  `GHSA-rc26-mrm2-6pf9`, `CVE-2026-81319`, `EEF-CVE-2026-81319` · Hex `ash_cloak`: affected `>=0.1.0, <0.4.0`, fixed in `0.4.0` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Insecure deserialization
- [Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export](https://agentprime.io/advisories/CVE-2026-76547.md)
  `CVE-2026-76547` · CVE record: Unknown User Profile Builder · CVSS 6.6 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Insecure deserialization
- [Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)](https://agentprime.io/advisories/GHSA-w23p-wrp7-ch38.md)
  `GHSA-w23p-wrp7-ch38`, `CVE-2026-55220`, `PKSA-kkjc-bw16-f3kq` · Packagist `pimcore/pimcore`: affected `<12.3.10 || >=2026.1.0, <2026.1.6`, fixed in `12.3.10`, `2026.1.6` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [Spinnaker: Improper yaml processing on kustomize bake operations](https://agentprime.io/advisories/GHSA-p68j-q7hf-3qcp.md)
  `GHSA-p68j-q7hf-3qcp`, `CVE-2026-55175` · Maven `io.spinnaker.rosco:rosco-manifests`: affected `<2025.3.4 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 || >=2026.1.0, <2026.1.1`, fixed in `2025.3.4`, `2025.4.4`, `2026.0.3`, `2026.1.1` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-81757.md)
  `CVE-2026-81757` · CVE record: Rank Math SEO Rank Math SEO · CVSS 7.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-82222.md)
  `CVE-2026-82222` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Tsuyoshi Saito SOY CMS](https://agentprime.io/advisories/CVE-2026-78032.md)
  `CVE-2026-78032` · CVE record: Tsuyoshi Saito SOY CMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder](https://agentprime.io/advisories/CVE-2026-14558.md)
  `CVE-2026-14558` · CVE record: Unknown User Frontend · CVSS 7.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Insecure deserialization
- [Dimension SQL Injection in Scheduled Report](https://agentprime.io/advisories/CVE-2026-78612.md)
  `CVE-2026-78612` · CVE record: WatchGuard Dimension · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection, Insecure deserialization
- [Dimension SQL Injection in Audit Report](https://agentprime.io/advisories/CVE-2026-78614.md)
  `CVE-2026-78614` · CVE record: WatchGuard Dimension · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: SQL injection, Insecure deserialization
- [SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing](https://agentprime.io/advisories/CVE-2026-10036.md)
  `CVE-2026-10036` · CVE record: speechbrain speechbrain · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Potential for deserialization of untrusted types in Spring Cloud Stream](https://agentprime.io/advisories/CVE-2026-59306.md)
  `CVE-2026-59306` · CVE record: Spring Spring Cloud Stream · CVSS 3.1 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference](https://agentprime.io/advisories/CVE-2026-59307.md)
  `CVE-2026-59307` · CVE record: Spring Spring Integration · CVSS 8.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Spring for GraphQL Unsafe Deserialization in pagination support](https://agentprime.io/advisories/CVE-2026-59285.md)
  `CVE-2026-59285` · CVE record: Spring Spring for GraphQL · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78292.md)
  `CVE-2026-78292` · CVE record: hashthemes Hash Form · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78286.md)
  `CVE-2026-78286` · CVE record: INFINITUM FORM Geo Controller · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78276.md)
  `CVE-2026-78276` · CVE record: WP Manage Ninja Fluent Boards Pro · CVSS 7.2 High · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78257.md)
  `CVE-2026-78257` · CVE record: magepeopleteam Booking and Rental Manager · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)](https://agentprime.io/advisories/CVE-2026-59275.md)
  `CVE-2026-59275` · CVE record: Spring Spring AMQP · CVSS 6.6 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist](https://agentprime.io/advisories/CVE-2026-47878.md)
  `CVE-2026-47878` · CVE record: Spring Spring Batch · CVSS 5.6 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [JobParameterDeserializer bypasses the trusted-type allowlist](https://agentprime.io/advisories/CVE-2026-47875.md)
  `CVE-2026-47875` · CVE record: Spring Spring Batch · CVSS 5.6 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution](https://agentprime.io/advisories/CVE-2026-47864.md)
  `CVE-2026-47864` · CVE record: Spring Spring Integration · CVSS 6.4 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Insecure deserialization
- [JsonToObjectTransformer resolves the json\_\_TypeId\_\_ message header to an arbitrary class without an allow-list](https://agentprime.io/advisories/CVE-2026-47856.md)
  `CVE-2026-47856` · CVE record: Spring Spring Integration · CVSS 6.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Insecure deserialization
- [ILIAS PHP Object Injection via Shibboleth Logout](https://agentprime.io/advisories/CVE-2026-80428.md)
  `CVE-2026-80428` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Insecure deserialization
- [An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component](https://agentprime.io/advisories/CVE-2026-51106.md)
  `CVE-2026-51106` · CVE record · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Denial of service, Insecure deserialization
- [Duplicate Advisory: Allowlisted pickle loaders still permit code execution in current source](https://agentprime.io/advisories/GHSA-vp9c-2pjm-8925.md)
  `GHSA-vp9c-2pjm-8925` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Insecure deserialization
- [TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)](https://agentprime.io/advisories/PKSA-nmhg-n7vm-6z1n.md)
  `PKSA-nmhg-n7vm-6z1n`, `CVE-2026-56095` · Packagist `apache-solr-for-typo3/solr`: affected `>=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4`, fixed in `11.6.6`, `12.1.4`, `13.1.4` · CVSS 7.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Insecure deserialization
- [Duplicate Advisory: \[CWE-502\] Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution](https://agentprime.io/advisories/GHSA-gx65-c5hj-vpv5.md)
  `GHSA-gx65-c5hj-vpv5` · PyPI `nltk`: affected `<=3.9.4`, no fixed version yet · CVSS 9.6 Critical · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Insecure deserialization
- [An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimd…](https://agentprime.io/advisories/CVE-2026-51368.md)
  `CVE-2026-51368` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Insecure deserialization
- [WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78265.md)
  `CVE-2026-78265` · CVE record: Nexcess The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78262.md)
  `CVE-2026-78262` · CVE record: weDevs WP Project Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32563.md)
  `CVE-2026-32563` · CVE record: A CPT ACPT (Pro) - Custom Post Types Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences](https://agentprime.io/advisories/CVE-2026-40877.md)
  `CVE-2026-40877` · CVE record: Combodo iTop · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection, Insecure deserialization
- [Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load](https://agentprime.io/advisories/CVE-2026-76843.md)
  `CVE-2026-76843` · CVE record: flairNLP flair · CVSS 8.4 High · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66650.md)
  `CVE-2026-66650` · CVE record: Theme-Rex FreightCo · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization](https://agentprime.io/advisories/CVE-2026-78147.md)
  `CVE-2026-78147` · CVE record: ggml-org llama.cpp · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Insecure deserialization, CWE-20
- [PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles](https://agentprime.io/advisories/CVE-2026-0551.md)
  `CVE-2026-0551` · CVE record: buildwps PPWP – Password Protect Pages · CVSS 8.8 High · Not analysed yet · Published 22 Aug 2026 · Tags: Insecure deserialization
- [NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution](https://agentprime.io/advisories/GHSA-5gh2-94qg-qppq.md)
  `GHSA-5gh2-94qg-qppq`, `CVE-2026-71513`, `PYSEC-2026-3867` · PyPI `nltk`: affected `>=3.10.0, <3.10.3`, fixed in `3.10.3` · CVSS 8.7 High · Not analysed yet · Published 22 Aug 2026 · Tags: Insecure deserialization
- [WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission](https://agentprime.io/advisories/CVE-2026-4703.md)
  `CVE-2026-4703` · CVE record: westguard WS Form LITE – Drag & Drop Contact Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Insecure deserialization
- [Server Side Request Forgery (SSRF) vulnerability reported in Windchill](https://agentprime.io/advisories/CVE-2026-77646.md)
  `CVE-2026-77646` · CVE record: PTC Windchill PDMLink and 1 more · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [Critical Remote Code Execution (RCE) vulnerability reported in Windchill](https://agentprime.io/advisories/CVE-2026-77645.md)
  `CVE-2026-77645` · CVE record: PTC Windchill PDMLink and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization, CWE-20
- [Microsoft Entra ID Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69836.md)
  `CVE-2026-69836` · CVE record: Microsoft Microsoft Entra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization
- [Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-15679.md)
  `CVE-2026-15679` · CVE record: Hugging Face PyTorch Image Models · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization
- [Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18285.md)
  `CVE-2026-18285` · CVE record: aeon aeon · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization
- [WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-73993.md)
  `CVE-2026-73993` · CVE record: Roxnor FundEngine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization
- [WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66672.md)
  `CVE-2026-66672` · CVE record: Monkeysan Flatastic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA4LTIwVDEyOjA3OjE0Ljk2MzAwMFoiLCJDVkUtMjAyNi02NjY3MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA5LTAxVDE2OjAyOjQ1Ljk5MjAwMFoiLCJDVkUtMjAyNi02MTc2MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA5LTAxVDE2OjAyOjQ1Ljk5MjAwMFoiLCJDVkUtMjAyNi02MTc2MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.