# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Sentry: Unsafe pickle deserialization in Relocation Feature](https://agentprime.io/advisories/CVE-2026-83803.md)
  `CVE-2026-83803` · CVE record: getsentry sentry · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths](https://agentprime.io/advisories/CVE-2026-95806.md)
  `CVE-2026-95806` · CVE record: MISP MISP · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, Insecure deserialization
- [CVE-2026-93088](https://agentprime.io/advisories/CVE-2026-93088.md)
  `CVE-2026-93088` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Speech](https://agentprime.io/advisories/CVE-2026-65179.md)
  `CVE-2026-65179` · CVE record: NVIDIA NeMo Speech · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Speech](https://agentprime.io/advisories/CVE-2026-65178.md)
  `CVE-2026-65178` · CVE record: NVIDIA NeMo Speech · CVSS 7.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Speech](https://agentprime.io/advisories/CVE-2026-24239.md)
  `CVE-2026-24239` · CVE record: NVIDIA NeMo Speech · CVSS 7.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA NeMo Speech](https://agentprime.io/advisories/CVE-2026-24267.md)
  `CVE-2026-24267` · CVE record: NVIDIA NeMo Speech · CVSS 7.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export](https://agentprime.io/advisories/CVE-2026-91827.md)
  `CVE-2026-91827` · CVE record: Unknown Ninja Forms · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify\[recipient\]\[personalized\]\[\]' Parameter](https://agentprime.io/advisories/CVE-2026-19658.md)
  `CVE-2026-19658` · CVE record: LiquidWeb Give Tributes · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232](https://agentprime.io/advisories/CVE-2026-94301.md)
  `CVE-2026-94301` · CVE record: Apache Software Foundation Apache MINA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data of the \_\_post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including \_\_r…](https://agentprime.io/advisories/CVE-2026-36471.md)
  `CVE-2026-36471` · CVE record · CVSS 5.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Insecure deserialization
- [DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization](https://agentprime.io/advisories/CVE-2026-94093.md)
  `CVE-2026-94093` · CVE record: DLR-RM stable-baselines3 · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [dmlc dgl utils.py \_read_torch_data deserialization](https://agentprime.io/advisories/CVE-2026-94092.md)
  `CVE-2026-94092` · CVE record: dmlc dgl · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [piskvorky gensim Model Loader utils.py load deserialization](https://agentprime.io/advisories/CVE-2026-94091.md)
  `CVE-2026-94091` · CVE record: piskvorky gensim · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection](https://agentprime.io/advisories/CVE-2026-85017.md)
  `CVE-2026-85017` · CVE record: Unknown Unlimited Elements For Elementor · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2026 · Tags: Insecure deserialization
- [Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter](https://agentprime.io/advisories/CVE-2026-93872.md)
  `CVE-2026-93872` · CVE record: Cotonti Cotonti · CVSS 7.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-81657.md)
  `CVE-2026-81657` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-11711.md)
  `CVE-2026-11711` · CVE record: IBM WebSphere Application Server · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py](https://agentprime.io/advisories/GHSA-2vh9-42vm-xmv2.md)
  `GHSA-2vh9-42vm-xmv2`, `CVE-2025-66455`, `PYSEC-2026-4077` · PyPI `lmdeploy`: affected `>=0.9.2, <0.16.0`, fixed in `0.16.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [IBM MQ Java messaging is vulnerable to remote code execution](https://agentprime.io/advisories/CVE-2026-10751.md)
  `CVE-2026-10751` · CVE record: IBM MQ · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content](https://agentprime.io/advisories/CVE-2026-17086.md)
  `CVE-2026-17086` · CVE record: shortpixel ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [HGiga｜OAKlouds - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-93467.md)
  `CVE-2026-93467` · CVE record: HGiga OAKlouds-custom_page-2.0 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request](https://agentprime.io/advisories/CVE-2026-54752.md)
  `CVE-2026-54752` · CVE record: netbox-community devicetype-library · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Insecure deserialization, CWE-829
- [b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key](https://agentprime.io/advisories/CVE-2026-76834.md)
  `CVE-2026-76834` · CVE record: b2evolution b2evolution CMS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Insecure deserialization
- [Kedro-Datasets: Remote code execution in experimental \`PyTorchDataset\` via unsafe \`torch.load\`](https://agentprime.io/advisories/CVE-2026-62997.md)
  `CVE-2026-62997` · CVE record: kedro-org kedro-plugins · CVSS 7.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes](https://agentprime.io/advisories/CVE-2026-92785.md)
  `CVE-2026-92785` · CVE record: Angel-ML angel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20340.md)
  `CVE-2026-20340` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20341.md)
  `CVE-2026-20341` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20242.md)
  `CVE-2026-20242` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Identity Services Engine Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20211.md)
  `CVE-2026-20211` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Identity Services Engine Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20307.md)
  `CVE-2026-20307` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy](https://agentprime.io/advisories/GHSA-5h8j-6crg-7rmw.md)
  `GHSA-5h8j-6crg-7rmw`, `CVE-2025-59953`, `PYSEC-2026-4079` · PyPI `lmdeploy`: affected `>=0.9.1, <0.10.2`, fixed in `0.10.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Dell ObjectScale](https://agentprime.io/advisories/CVE-2026-70416.md)
  `CVE-2026-70416` · CVE record: Dell ObjectScale · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter](https://agentprime.io/advisories/CVE-2026-91939.md)
  `CVE-2026-91939` · CVE record: Cotonti Cotonti · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization
- [IBM MQ Java messaging is vulnerable to remote code execution](https://agentprime.io/advisories/CVE-2026-11729.md)
  `CVE-2026-11729` · CVE record: IBM MQ · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization
- [IBM MQ Java messaging is vulnerable to remote code execution](https://agentprime.io/advisories/CVE-2026-12728.md)
  `CVE-2026-12728` · CVE record: IBM MQ · CVSS 8.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization
- [Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet](https://agentprime.io/advisories/CVE-2023-54398.md)
  `CVE-2023-54398` · CVE record: Yonyou U8 Cloud · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization
- [OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization](https://agentprime.io/advisories/CVE-2026-91842.md)
  `CVE-2026-91842` · CVE record: OpenBankProject OBP-API · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [IBM MQ Java messaging is vulnerable to remote code execution](https://agentprime.io/advisories/CVE-2026-13293.md)
  `CVE-2026-13293` · CVE record: IBM MQ · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in WebPros WHMCS](https://agentprime.io/advisories/CVE-2026-67399.md)
  `CVE-2026-67399` · CVE record: WebPros WHMCS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs](https://agentprime.io/advisories/CVE-2026-17156.md)
  `CVE-2026-17156` · CVE record: IBM App Connect Enterprise · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs](https://agentprime.io/advisories/CVE-2026-17416.md)
  `CVE-2026-17416` · CVE record: IBM App Connect Enterprise · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [October CMS: PHP Object Injection via Backend Widget Session Storage](https://agentprime.io/advisories/GHSA-2ff2-mx52-q8wp.md)
  `GHSA-2ff2-mx52-q8wp`, `CVE-2026-49400`, `PKSA-syjw-hb9p-2d5m` · Packagist `october/system`: affected `<3.7.17 || >=4.0.0, <4.2.23`, fixed in `3.7.17`, `4.2.23` · CVSS 3.3 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-90919.md)
  `CVE-2026-90919` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization](https://agentprime.io/advisories/CVE-2026-90614.md)
  `CVE-2026-90614` · CVE record: FedML-AI FedML · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [PHPGurukul Small CRM Login Success login.php unserialize deserialization](https://agentprime.io/advisories/CVE-2026-90575.md)
  `CVE-2026-90575` · CVE record: PHPGurukul Small CRM · CVSS 6.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [ESPnet before 202609 Remote Code Execution via Unsafe Deserialization](https://agentprime.io/advisories/CVE-2026-90777.md)
  `CVE-2026-90777` · CVE record: espnet espnet · CVSS 8.7 High · Not analysed yet · Published 13 Sept 2026 · Tags: Insecure deserialization
- [lenve vhr MailReceiver deserialization](https://agentprime.io/advisories/CVE-2026-90490.md)
  `CVE-2026-90490` · CVE record: lenve vhr · CVSS 5.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Insecure deserialization, CWE-20
- [Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-78175.md)
  `CVE-2026-78175` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 8.8 High · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-78006.md)
  `CVE-2026-78006` · CVE record: stellarwp The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php](https://agentprime.io/advisories/CVE-2026-84099.md)
  `CVE-2026-84099` · CVE record: Unknown wpstorecart · CVSS 8.1 High · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection](https://agentprime.io/advisories/CVE-2026-82845.md)
  `CVE-2026-82845` · CVE record: Unknown Masteriyo LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of Untrusted Data in GitLab](https://agentprime.io/advisories/CVE-2026-87719.md)
  `CVE-2026-87719` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62107.md)
  `CVE-2026-62107` · CVE record: masteriyo Masteriyo - LMS · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Insecure deserialization
- [WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62105.md)
  `CVE-2026-62105` · CVE record: ThemeRex ThemeREX Addons · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Insecure deserialization
- [WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62103.md)
  `CVE-2026-62103` · CVE record: wpeverest Everest Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Insecure deserialization
- [FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()](https://agentprime.io/advisories/CVE-2026-73699.md)
  `CVE-2026-73699` · CVE record: FileRun FileRun · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Insecure deserialization
- [WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81784.md)
  `CVE-2026-81784` · CVE record: Marcin Wise Chat · CVSS 8.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Insecure deserialization
- [Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature](https://agentprime.io/advisories/CVE-2026-82925.md)
  `CVE-2026-82925` · CVE record: Unknown Site Reviews · CVSS 8.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Insecure deserialization
- [Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service](https://agentprime.io/advisories/CVE-2026-57822.md)
  `CVE-2026-57822` · CVE record: Apache Software Foundation Apache Artemis and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTA5LTEwVDA0OjQ2OjUyLjE5MjAwMFoiLCJDVkUtMjAyNi01NzgyMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTA5LTIyVDE3OjAxOjU2LjQ2NTAwMFoiLCJDVkUtMjAyNi04MzYwMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTA5LTIyVDE3OjAxOjU2LjQ2NTAwMFoiLCJDVkUtMjAyNi04MzYwMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.