# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [MaxSite CMS through 109.6 PHP Object Injection via ci_session](https://agentprime.io/advisories/CVE-2026-87930.md)
  `CVE-2026-87930` · CVE record: MaxSite MaxSite CMS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Insecure deserialization
- [Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller](https://agentprime.io/advisories/CVE-2026-87874.md)
  `CVE-2026-87874` · CVE record: Red Hat Red Hat Ceph Storage 5 and 3 more · CVSS 8.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: Insecure deserialization
- [Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import](https://agentprime.io/advisories/CVE-2026-11363.md)
  `CVE-2026-11363` · CVE record: kstover Ninja Forms – The Contact Form Builder That Grows With You · CVSS 6.6 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Insecure deserialization
- [tile-ai tilelang Kernel Cache kernel_cache.py KernelCache.\_load_kernel_from_disk deserialization](https://agentprime.io/advisories/CVE-2026-87083.md)
  `CVE-2026-87083` · CVE record: tile-ai tilelang · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-gh2h-rhph-h37g.md)
  `GHSA-gh2h-rhph-h37g`, `BIT-dotnet-2026-50646`, `BIT-dotnet-sdk-2026-50646`, `CVE-2026-50646` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization, CWE-693
- [Microsoft Office Publisher Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-81385.md)
  `CVE-2026-81385` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-77484.md)
  `CVE-2026-77484` · CVE record: Microsoft Microsoft SQL Server 2019 (CU 32) and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65772.md)
  `CVE-2026-65772` · CVE record: Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-47297.md)
  `CVE-2026-47297` · CVE record: Microsoft Microsoft SQL Server 2019 (CU 32) and 4 more · CVSS 8.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69694.md)
  `CVE-2026-69694` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [NLTK: Allowlisted pickle loaders still permit code execution in current source](https://agentprime.io/advisories/GHSA-x99w-6fgc-pmfw.md)
  `GHSA-x99w-6fgc-pmfw`, `CVE-2026-79657`, `PYSEC-2026-3735` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization, CWE-693
- [NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution](https://agentprime.io/advisories/GHSA-rhp5-r9x4-f5g2.md)
  `GHSA-rhp5-r9x4-f5g2`, `CVE-2026-78683`, `PYSEC-2026-3734` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Neurons for ITSM](https://agentprime.io/advisories/CVE-2026-12648.md)
  `CVE-2026-12648` · CVE record: Ivanti Neurons for ITSM · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Neurons for ITSM](https://agentprime.io/advisories/CVE-2026-12650.md)
  `CVE-2026-12650` · CVE record: Ivanti Neurons for ITSM · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Neurons for ITSM](https://agentprime.io/advisories/CVE-2026-12651.md)
  `CVE-2026-12651` · CVE record: Ivanti Neurons for ITSM · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Neurons for ITSM](https://agentprime.io/advisories/CVE-2026-12745.md)
  `CVE-2026-12745` · CVE record: Ivanti Neurons for ITSM · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Ivanti Neurons for ITSM](https://agentprime.io/advisories/CVE-2026-12744.md)
  `CVE-2026-12744` · CVE record: Ivanti Neurons for ITSM · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Content Extractor Privilege Escalation](https://agentprime.io/advisories/CVE-2026-77092.md)
  `CVE-2026-77092` · CVE record: Commvault Commvault Cloud · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode](https://agentprime.io/advisories/CVE-2026-16502.md)
  `CVE-2026-16502` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container](https://agentprime.io/advisories/CVE-2026-71374.md)
  `CVE-2026-71374` · CVE record: Hitachi Cosminexus Component Container · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Insecure Deserialization in SAP NetWeaver Business Client](https://agentprime.io/advisories/CVE-2026-76967.md)
  `CVE-2026-76967` · CVE record: SAP_SE SAP NetWeaver Business Client · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Insecure deserialization
- [Code Injection in Next4Biz's CSM (Customer Service Management)](https://agentprime.io/advisories/CVE-2026-7861.md)
  `CVE-2026-7861` · CVE record: Next4Biz Information Technologies Inc. CSM (Customer Service Management) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Insecure deserialization
- [Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default](https://agentprime.io/advisories/CVE-2026-86404.md)
  `CVE-2026-86404` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 8.8 High · Not analysed yet · Published 7 Sept 2026 · Tags: Insecure deserialization
- [Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields](https://agentprime.io/advisories/CVE-2026-10196.md)
  `CVE-2026-10196` · CVE record: getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Insecure deserialization
- [Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback](https://agentprime.io/advisories/CVE-2026-19887.md)
  `CVE-2026-19887` · CVE record: uscnanbu Welcart e-Commerce · CVSS 8.8 High · Not analysed yet · Published 5 Sept 2026 · Tags: Insecure deserialization
- [SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop](https://agentprime.io/advisories/CVE-2026-61686.md)
  `CVE-2026-61686` · CVE record: SolidInvoice SolidInvoice · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Insecure deserialization
- [Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.](https://agentprime.io/advisories/CVE-2026-19795.md)
  `CVE-2026-19795` · CVE record: IBM Qiskit SDK · CVSS 6.2 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84834.md)
  `CVE-2026-84834` · CVE record: eyecix JobSearch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84753.md)
  `CVE-2026-84753` · CVE record: WPFunnels Mail Mint · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84752.md)
  `CVE-2026-84752` · CVE record: rometheme RTMKit · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [Unsafe deserialization in the REST interface](https://agentprime.io/advisories/CVE-2026-84832.md)
  `CVE-2026-84832` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 8.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection, Insecure deserialization
- [Deserialization of untrusted data in Jenkins Project Jenkins Performance Plugin](https://agentprime.io/advisories/CVE-2026-84670.md)
  `CVE-2026-84670` · CVE record: Jenkins Project Jenkins Performance Plugin · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-84650.md)
  `CVE-2026-84650` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization, CWE-566
- [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-84647.md)
  `CVE-2026-84647` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Jenkins](https://agentprime.io/advisories/CVE-2026-84646.md)
  `CVE-2026-84646` · CVE record: Jenkins Project Jenkins · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection](https://agentprime.io/advisories/CVE-2023-3360.md)
  `CVE-2023-3360` · CVE record: Unknown Weaver Show Posts · CVSS 3.3 Low · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81772.md)
  `CVE-2026-81772` · CVE record: Saturday Drive Ninja Forms - Layout & Styles · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81283.md)
  `CVE-2026-81283` · CVE record: weDevs WP User Frontend · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form](https://agentprime.io/advisories/CVE-2026-19116.md)
  `CVE-2026-19116` · CVE record: Unknown User Frontend · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Insecure deserialization
- [Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter](https://agentprime.io/advisories/CVE-2026-71981.md)
  `CVE-2026-71981` · CVE record: cypht-org cypht · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-72649.md)
  `CVE-2026-72649` · CVE record: Elastic Elasticsearch · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact](https://agentprime.io/advisories/GHSA-gqvg-gmmx-x4hm.md)
  `GHSA-gqvg-gmmx-x4hm` · PyPI `mlflow`: affected `>=2.1.0, <3.15.0`, fixed in `3.15.0` · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61769.md)
  `CVE-2026-61769` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61777.md)
  `CVE-2026-61777` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61778.md)
  `CVE-2026-61778` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61779.md)
  `CVE-2026-61779` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61770.md)
  `CVE-2026-61770` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61771.md)
  `CVE-2026-61771` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61772.md)
  `CVE-2026-61772` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61773.md)
  `CVE-2026-61773` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61774.md)
  `CVE-2026-61774` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61775.md)
  `CVE-2026-61775` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61776.md)
  `CVE-2026-61776` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61766.md)
  `CVE-2026-61766` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61767.md)
  `CVE-2026-61767` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61768.md)
  `CVE-2026-61768` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61760.md)
  `CVE-2026-61760` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61761.md)
  `CVE-2026-61761` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61762.md)
  `CVE-2026-61762` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron Bridge](https://agentprime.io/advisories/CVE-2026-61763.md)
  `CVE-2026-61763` · CVE record: NVIDIA Megatron Bridge · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA5LTAxVDE2OjAyOjQ1Ljk5MjAwMFoiLCJDVkUtMjAyNi02MTc2MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA5LTEwVDA0OjQ2OjUyLjE5MjAwMFoiLCJDVkUtMjAyNi01NzgyMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA5LTEwVDA0OjQ2OjUyLjE5MjAwMFoiLCJDVkUtMjAyNi01NzgyMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.