# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool](https://agentprime.io/advisories/GHSA-7vp9-x248-9vr9.md) `GHSA-7vp9-x248-9vr9`, `CVE-2026-0859`, `PKSA-rtck-8z1q-gn5s` · Packagist `typo3/cms-core`: affected `>=10.0.0, <10.4.55 || >=11.0.0, <11.5.49 || >=12.0.0, <12.4.41 || >=13.0.0, <13.4.23 || >=14.0.0, <14.0.2`, fixed in `10.4.55`, `11.5.49`, `12.4.41`, `13.4.23`, `14.0.2` · CVSS 5.2 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Insecure deserialization - [Azure Core is vulnerable to deserialization of untrusted data](https://agentprime.io/advisories/GHSA-jm66-cg57-jjv5.md) `GHSA-jm66-cg57-jjv5`, `CVE-2026-21226`, `PYSEC-2026-1208` · PyPI `azure-core`: affected `<1.38.0`, fixed in `1.38.0` · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: Insecure deserialization - [UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation](https://agentprime.io/advisories/GHSA-vrgw-pc9c-qrrc.md) `GHSA-vrgw-pc9c-qrrc`, `CVE-2025-68924` · NuGet `UmbracoForms`: affected `<=8.13.16`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection, Insecure deserialization, Broken access control, CWE-829 - [Microsoft SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20963.md) `CVE-2026-20963` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.29 · Not analysed yet · Published 13 Jan 2026 · Tags: Insecure deserialization - [LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. ...](https://agentprime.io/advisories/PYSEC-2026-85.md) `PYSEC-2026-85`, `CVE-2024-14021` · PyPI `llama-index`: affected `<0.11.7`, fixed in `0.11.7` · CVSS 8.4 High · Not analysed yet · Published 12 Jan 2026 · Tags: Insecure deserialization - [Spectrum insecure deserialiation](https://agentprime.io/advisories/CVE-2025-69276.md) `CVE-2025-69276` · CVE record: Broadcom DX NetOps Spectrum · CVSS 2.3 Low · Not analysed yet · Published 12 Jan 2026 · Tags: Insecure deserialization - [Fickling vulnerable to detection bypass due to "builtins" blindness](https://agentprime.io/advisories/GHSA-h4rm-mm56-xf63.md) `GHSA-h4rm-mm56-xf63`, `CVE-2026-22612`, `PYSEC-2026-1370` · PyPI `fickling`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Insecure deserialization - [Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist](https://agentprime.io/advisories/GHSA-q5qq-mvfm-j35x.md) `GHSA-q5qq-mvfm-j35x`, `CVE-2026-22609`, `PYSEC-2026-1372` · PyPI `fickling`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Insecure deserialization, CWE-184 - [Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection](https://agentprime.io/advisories/GHSA-5hvc-6wx8-mvv4.md) `GHSA-5hvc-6wx8-mvv4`, `CVE-2026-22608`, `PYSEC-2026-1369` · PyPI `fickling`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Insecure deserialization, CWE-184 - [Fickling Blocklist Bypass: cProfile.run()](https://agentprime.io/advisories/GHSA-p523-jq9w-64x9.md) `GHSA-p523-jq9w-64x9`, `CVE-2026-22607`, `PYSEC-2026-1371` · PyPI `fickling`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Insecure deserialization, CWE-184 - [Fickling has a bypass via runpy.run_path() and runpy.run_module()](https://agentprime.io/advisories/GHSA-wfq2-52f7-7qvj.md) `GHSA-wfq2-52f7-7qvj`, `CVE-2026-22606`, `PYSEC-2026-1373` · PyPI `fickling`: affected `<0.1.7`, fixed in `0.1.7` · CVSS 8.9 High · Not analysed yet · Published 9 Jan 2026 · Tags: Insecure deserialization, CWE-184 - [vLLM introduced enhanced protection for CVE-2025-62164](https://agentprime.io/advisories/GHSA-mcmc-2m55-j8jj.md) `GHSA-mcmc-2m55-j8jj`, `CVE-2026-56340`, `PYSEC-2026-250` · PyPI `vllm`: affected `>=0.10.2, <0.13.0`, fixed in `0.13.0` · CVSS 8.7 High · Not analysed yet · Published 8 Jan 2026 · Tags: Insecure deserialization, Memory corruption, CWE-20, CWE-123 - [WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67911.md) `CVE-2025-67911` · CVE record: Tribulant Software Newsletters · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jan 2026 · Tags: Insecure deserialization - [Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing](https://agentprime.io/advisories/GHSA-qjm3-cvp9-3jj3.md) `GHSA-qjm3-cvp9-3jj3`, `CVE-2026-22187` · Maven `ome:pom-bio-formats`: affected `<=8.3.0`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Insecure deserialization - [WordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-47552.md) `CVE-2025-47552` · CVE record: Digital zoom studio DZS Video Gallery · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2026 · Tags: Insecure deserialization - [WordPress DZS Video Gallery plugin <= 12.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-47553.md) `CVE-2025-47553` · CVE record: Digital zoom studio DZS Video Gallery · CVSS 8.8 High · Not analysed yet · Published 6 Jan 2026 · Tags: Insecure deserialization - [WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-31047.md) `CVE-2025-31047` · CVE record: Themify Themify Edmin · CVSS 8.8 High · Not analysed yet · Published 5 Jan 2026 · Tags: Insecure deserialization - [milvus HTTP Endpoint expr.go expr.Exec deserialization](https://agentprime.io/advisories/CVE-2025-15453.md) `CVE-2025-15453` · CVE record: milvus · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Insecure deserialization, CWE-20 - [PluXml Media Management medias.php \_\_destruct deserialization](https://agentprime.io/advisories/CVE-2025-15438.md) `CVE-2025-15438` · CVE record: PluXml · CVSS 5.1 Medium · Not analysed yet · Published 2 Jan 2026 · Tags: Insecure deserialization, CWE-20 - [Feast vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-34wm-4hw7-qfjv.md) `GHSA-34wm-4hw7-qfjv`, `CVE-2025-11157`, `PYSEC-2026-1366` · PyPI `feast`: affected `<0.54.0`, fixed in `0.54.0` · CVSS 7.8 High · Not analysed yet · Published 1 Jan 2026 · Tags: Insecure deserialization - [TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)](https://agentprime.io/advisories/PKSA-6xxy-q4qw-wtq1.md) `PKSA-6xxy-q4qw-wtq1`, `CVE-2026-77138` · Packagist `lochmueller/html5videoplayer-powermail`: affected `<=0.2.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jan 2026 · Tags: Insecure deserialization - [FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-15276.md) `CVE-2025-15276` · CVE record: FontForge FontForge · CVSS 7.8 High · Not analysed yet · Published 31 Dec 2025 · Tags: Insecure deserialization - [EyouCMS arcpagelist Ajax.php unserialize deserialization](https://agentprime.io/advisories/CVE-2025-15375.md) `CVE-2025-15375` · CVE record: EyouCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Insecure deserialization, CWE-20 - [Picklescan is vulnerable to RCE via missing detection when calling built-in python \_operator.attrgetter](https://agentprime.io/advisories/GHSA-46h3-79wf-xr6c.md) `GHSA-46h3-79wf-xr6c`, `CVE-2025-71367` · PyPI `picklescan`: affected `<0.0.34`, fixed in `0.0.34` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE via missing detection when calling built-in python \_operator.methodcaller](https://agentprime.io/advisories/GHSA-955r-x9j8-7rhh.md) `GHSA-955r-x9j8-7rhh`, `CVE-2025-71375` · PyPI `picklescan`: affected `<0.0.34`, fixed in `0.0.34` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.\_eval_length](https://agentprime.io/advisories/GHSA-6556-fwc2-fg2p.md) `GHSA-6556-fwc2-fg2p`, `CVE-2025-71339`, `PYSEC-2026-1783` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef](https://agentprime.io/advisories/GHSA-rrxm-2pvv-m66x.md) `GHSA-rrxm-2pvv-m66x`, `CVE-2025-71372` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization - [aizuda snail-job API FurySerializer.deserialize deserialization](https://agentprime.io/advisories/CVE-2025-15246.md) `CVE-2025-15246` · CVE record: aizuda snail-job · CVSS 5.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Insecure deserialization, CWE-20 - [Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization](https://agentprime.io/advisories/CVE-2025-15222.md) `CVE-2025-15222` · CVE record: Dromara Sa-Token · CVSS 2.3 Low · Not analysed yet · Published 30 Dec 2025 · Tags: Insecure deserialization, CWE-20 - [Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval](https://agentprime.io/advisories/GHSA-cffc-mxrf-mhh4.md) `GHSA-cffc-mxrf-mhh4`, `CVE-2025-71347` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval](https://agentprime.io/advisories/GHSA-3329-ghmp-jmv5.md) `GHSA-3329-ghmp-jmv5`, `CVE-2025-71365`, `PYSEC-2026-4131` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller](https://agentprime.io/advisories/GHSA-x843-g5mx-g377.md) `GHSA-x843-g5mx-g377`, `CVE-2025-71373` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization, CWE-693 - [Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef](https://agentprime.io/advisories/GHSA-r8g5-cgf2-4m4m.md) `GHSA-r8g5-cgf2-4m4m`, `CVE-2025-71362` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Insecure deserialization - [Picklescan missing detection when calling pty.spawn](https://agentprime.io/advisories/GHSA-vqmv-47xg-9wpr.md) `GHSA-vqmv-47xg-9wpr` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 4.0, no score published · Not analysed yet · Published 29 Dec 2025 · Tags: Insecure deserialization - [Picklescan vulnerable to Arbitrary File Writing](https://agentprime.io/advisories/GHSA-m273-6v24-x4m4.md) `GHSA-m273-6v24-x4m4`, `CVE-2025-71321`, `PYSEC-2026-1791` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Dec 2025 · Tags: Insecure deserialization, Information disclosure - [Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization](https://agentprime.io/advisories/CVE-2025-15117.md) `CVE-2025-15117` · CVE record: Dromara Sa-Token · CVSS 2.3 Low · Not analysed yet · Published 28 Dec 2025 · Tags: Insecure deserialization, CWE-20 - [lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()](https://agentprime.io/advisories/GHSA-9pf3-7rrr-x5jh.md) `GHSA-9pf3-7rrr-x5jh`, `CVE-2025-67729`, `PYSEC-2026-1578` · PyPI `lmdeploy`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 8.8 High · Not analysed yet · Published 26 Dec 2025 · Tags: Insecure deserialization - [WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68038.md) `CVE-2025-68038` · CVE record: Icegram Icegram Express Pro · CVSS 7.2 High · Not analysed yet · Published 24 Dec 2025 · Tags: Insecure deserialization - [Tencent FaceDetection-DSFD resnet Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13715.md) `CVE-2025-13715` · CVE record: Tencent FaceDetection-DSFD · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13709.md) `CVE-2025-13709` · CVE record: Tencent TFace · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13711.md) `CVE-2025-13711` · CVE record: Tencent TFace · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent PatrickStar merge_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13706.md) `CVE-2025-13706` · CVE record: Tencent PatrickStar · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent NeuralNLP-NeuralClassifier \_load_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13708.md) `CVE-2025-13708` · CVE record: Tencent NeuralNLP-NeuralClassifier · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent MimicMotion create_pipeline Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13716.md) `CVE-2025-13716` · CVE record: Tencent MimicMotion · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent MedicalNet generate_model Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13714.md) `CVE-2025-13714` · CVE record: Tencent MedicalNet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent HunyuanVideo load_vae Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13710.md) `CVE-2025-13710` · CVE record: Tencent HunyuanVideo · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent HunyuanDiT model_resume Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13707.md) `CVE-2025-13707` · CVE record: Tencent HunyuanDiT · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent HunyuanDiT merge Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13712.md) `CVE-2025-13712` · CVE record: Tencent HunyuanDiT · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Tencent Hunyuan3D-1 load_pretrained Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-13713.md) `CVE-2025-13713` · CVE record: Tencent Hunyuan3D-1 · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations ...](https://agentprime.io/advisories/PYSEC-2025-218.md) `PYSEC-2025-218`, `CVE-2025-14930` · PyPI `transformers`: affected `<=4.57.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...](https://agentprime.io/advisories/PYSEC-2025-217.md) `PYSEC-2025-217`, `CVE-2025-14929` · PyPI `transformers`: affected `<=5.0.0-rc0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected insta...](https://agentprime.io/advisories/PYSEC-2025-213.md) `PYSEC-2025-213`, `CVE-2025-14924` · PyPI `transformers`: affected `<=4.55.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte...](https://agentprime.io/advisories/PYSEC-2025-212.md) `PYSEC-2025-212`, `CVE-2025-14921` · PyPI `transformers`: affected `<=4.54.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ins...](https://agentprime.io/advisories/PYSEC-2025-211.md) `PYSEC-2025-211`, `CVE-2025-14920` · PyPI `transformers`: affected `<=4.54.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Accelerate Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14925.md) `CVE-2025-14925` · CVE record: Hugging Face Accelerate · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Hugging Face Diffusers CogView4 Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-14922.md) `CVE-2025-14922` · CVE record: Hugging Face Diffusers · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [LangChain serialization injection vulnerability enables secret extraction](https://agentprime.io/advisories/GHSA-r399-636x-v7f6.md) `GHSA-r399-636x-v7f6`, `CVE-2025-68665` · npm `langchain` and 1 more: affected `<0.3.37 || >=1.0.0, <1.2.3`, fixed in `0.3.37`, `1.2.3` · CVSS 8.6 High · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs](https://agentprime.io/advisories/GHSA-c67j-w6g6-q2cm.md) `GHSA-c67j-w6g6-q2cm`, `CVE-2025-68664`, `PYSEC-2026-373` · PyPI `langchain-core`: affected `<0.3.81 || >=1.0.0, <1.2.5`, fixed in `0.3.81`, `1.2.5` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.43 · Not analysed yet · Published 23 Dec 2025 · Tags: Insecure deserialization - [Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode](https://agentprime.io/advisories/CVE-2025-14071.md) `CVE-2025-14071` · CVE record: livecomposer Live Composer – Free WordPress Website Builder · CVSS 7.5 High · Not analysed yet · Published 21 Dec 2025 · Tags: Insecure deserialization - [Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization](https://agentprime.io/advisories/GHSA-4hx9-48xh-5mxr.md) `GHSA-4hx9-48xh-5mxr`, `CVE-2025-13467` · Maven `org.keycloak:keycloak-ldap-federation`: affected `>=26.3.0, <26.4.6 || <26.2.11`, fixed in `26.4.6`, `26.2.11` · CVSS 5.5 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .