# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution](https://agentprime.io/advisories/GHSA-r33w-fg8j-9c94.md) `GHSA-r33w-fg8j-9c94`, `CVE-2026-61701`, `PKSA-n3xg-c9dz-5k25` · Packagist `cesargb/laravel-magiclink`: affected `>=2.0.0, <2.25.1`, fixed in `2.25.1` · CVSS 8.8 High · Not analysed yet · Published 12 Feb 2026 · Tags: Insecure deserialization - [In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.](https://agentprime.io/advisories/CVE-2025-61880.md) `CVE-2025-61880` · CVE record · CVSS 8.8 High · Not analysed yet · Published 12 Feb 2026 · Tags: Insecure deserialization - [manga-image-translator Shared API Unsafe Deserialization RCE](https://agentprime.io/advisories/CVE-2026-26215.md) `CVE-2026-26215` · CVE record: zyddnys manga-image-translator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Feb 2026 · Tags: Insecure deserialization - [DiskCache has unsafe pickle deserialization](https://agentprime.io/advisories/GHSA-w8v5-vhqr-4h9v.md) `GHSA-w8v5-vhqr-4h9v`, `CVE-2025-69872`, `PYSEC-2026-2447` · PyPI `diskcache`: affected `<=5.6.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Feb 2026 · Tags: Code injection, Insecure deserialization - [wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection](https://agentprime.io/advisories/CVE-2026-0910.md) `CVE-2026-0910` · CVE record: tomdever wpForo Forum · CVSS 8.8 High · Not analysed yet · Published 11 Feb 2026 · Tags: Insecure deserialization - [WP eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-1235.md) `CVE-2026-1235` · CVE record: Unknown WP eCommerce · CVSS 6.5 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: Insecure deserialization - [Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE](https://agentprime.io/advisories/GHSA-436v-jg82-p533.md) `GHSA-436v-jg82-p533`, `CVE-2026-21531`, `PYSEC-2026-289` · PyPI `azure-ai-language-conversations-authoring`: affected `<1.0.0b4`, fixed in `1.0.0b4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Feb 2026 · Tags: Insecure deserialization - [Microsoft Outlook Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-21511.md) `CVE-2026-21511` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2026 · Tags: Insecure deserialization - [Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)](https://agentprime.io/advisories/CVE-2026-23685.md) `CVE-2026-23685` · CVE record: SAP_SE SAP NetWeaver (JMS service) · CVSS 4.4 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: Insecure deserialization - [PowerDocu Affected by Remote Code Execution via Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-25925.md) `CVE-2026-25925` · CVE record: modery PowerDocu · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: Insecure deserialization - [Phar Deserialization leading to Arbitrary File Deletion in my little forum](https://agentprime.io/advisories/CVE-2026-25923.md) `CVE-2026-25923` · CVE record: My-Little-Forum mylittleforum · CVSS 8.7 High · Not analysed yet · Published 9 Feb 2026 · Tags: Unrestricted file upload, Insecure deserialization - [yuan1994 tpadmin WebUploader preview.php deserialization](https://agentprime.io/advisories/CVE-2026-2113.md) `CVE-2026-2113` · CVE record: yuan1994 tpadmin · CVSS 6.9 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: Insecure deserialization, CWE-20 - [EPyT-Flow vulnerable to unsafe JSON deserialization (\_\_type\_\_)](https://agentprime.io/advisories/GHSA-74vm-8frp-7w68.md) `GHSA-74vm-8frp-7w68`, `CVE-2026-25632`, `PYSEC-2026-330` · PyPI `epyt-flow`: affected `<0.16.1`, fixed in `0.16.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2026 · Tags: Insecure deserialization - [CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution](https://agentprime.io/advisories/CVE-2020-37071.md) `CVE-2020-37071` · CVE record: CraftCMS CraftCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Blesta](https://agentprime.io/advisories/CVE-2026-25615.md) `CVE-2026-25615` · CVE record: Blesta Blesta · CVSS 7.2 High · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Blesta](https://agentprime.io/advisories/CVE-2026-25614.md) `CVE-2026-25614` · CVE record: Blesta Blesta · CVSS 7.5 High · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [Boltz contains an insecure deserialization vulnerability in its molecule loading functionality](https://agentprime.io/advisories/GHSA-fjm6-8xp2-4fwc.md) `GHSA-fjm6-8xp2-4fwc`, `CVE-2025-70560`, `PYSEC-2026-1224` · PyPI `boltz`: affected `<=2.0.0`, no fixed version yet · CVSS 8.4 High · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [Duplicate Advisory: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc](https://agentprime.io/advisories/GHSA-8x2r-v9x5-3qgh.md) `GHSA-8x2r-v9x5-3qgh` · PyPI `pdfminer-six`: affected `<20251230`, fixed in `20251230` · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-24954.md) `CVE-2026-24954` · CVE record: magepeopleteam WpEvently · CVSS 8.8 High · Not analysed yet · Published 3 Feb 2026 · Tags: Insecure deserialization - [picklescan vulnerable to arbitrary file create using logging.FileHandler](https://agentprime.io/advisories/GHSA-m7j5-r2p5-c39r.md) `GHSA-m7j5-r2p5-c39r`, `CVE-2026-56304`, `PYSEC-2026-225` · PyPI `picklescan`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Insecure deserialization - [picklescan missing detection by simple obfuscation of a \`builtins.eval\` call](https://agentprime.io/advisories/GHSA-9m3x-qqw2-h32h.md) `GHSA-9m3x-qqw2-h32h`, `CVE-2026-53874`, `PYSEC-2026-1789` · PyPI `picklescan`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Insecure deserialization - [bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization](https://agentprime.io/advisories/CVE-2026-1691.md) `CVE-2026-1691` · CVE record: bolo-solo · CVSS 5.3 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Insecure deserialization, CWE-20 - [React Server Components have multiple Denial of Service Vulnerabilities](https://agentprime.io/advisories/GHSA-83fc-fqcc-2hmg.md) `GHSA-83fc-fqcc-2hmg`, `CVE-2026-23864` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.4 || >=19.1.0-canary-7130d0c6-20241212, <19.1.5 || >=19.2.0-canary-63779030-20250328, <19.2.4`, fixed in `19.0.4`, `19.1.5`, `19.2.4` · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2026 · Tags: Denial of service, Insecure deserialization, CWE-1284 - [JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js](https://agentprime.io/advisories/GHSA-6c59-mwgh-r2x6.md) `GHSA-6c59-mwgh-r2x6`, `CVE-2025-61140` · npm `jsonpath`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jan 2026 · Tags: Insecure deserialization, Prototype pollution - [Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components](https://agentprime.io/advisories/GHSA-h25m-26qc-wcjf.md) `GHSA-h25m-26qc-wcjf`, `CVE-2026-23864` · npm `next`: affected `>=13.0.0, <15.0.8 || >=15.1.1-canary.0, <15.1.12 || >=15.2.0-canary.0, <15.2.9 || >=15.3.0-canary.0, <15.3.9 || >=15.4.0-canary.0, <15.4.11 || >=15.5.1-canary.0, <15.5.10 || >=15.6.0-canary.0, <15.6.0-canary.61 || >=16.0.0-beta.0, <16.0.11 || >=16.1.0-canary.0, <16.1.5`, fixed in `15.0.8`, `15.1.12`, `15.2.9`, `15.3.9`, `15.4.11`, `15.5.10`, `15.6.0-canary.61`, `16.0.11`, `16.1.5` · CVSS 7.5 High · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service, Insecure deserialization, CWE-1284 - [SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40553.md) `CVE-2025-40553` · CVE record: SolarWinds Web Help Desk · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.68 · Not analysed yet · Published 28 Jan 2026 · Tags: Insecure deserialization - [SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40551.md) `CVE-2025-40551` · CVE record: SolarWinds Web Help Desk · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.84 · Not analysed yet · Published 28 Jan 2026 · Tags: Insecure deserialization - [PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling](https://agentprime.io/advisories/GHSA-vvj3-c3rp-c85p.md) `GHSA-vvj3-c3rp-c85p`, `CVE-2026-24765`, `PKSA-z3gr-8qht-p93v` · Packagist `phpunit/phpunit`: affected `<8.5.52 || >=9.0.0, <9.6.33 || >=10.0.0, <10.5.62 || >=11.0.0, <11.5.50 || >=12.0.0, <12.5.8`, fixed in `8.5.52`, `9.6.33`, `10.5.62`, `11.5.50`, `12.5.8` · CVSS 7.8 High · Not analysed yet · Published 27 Jan 2026 · Tags: Insecure deserialization - [PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files](https://agentprime.io/advisories/GHSA-63cw-57p8-fm3p.md) `GHSA-63cw-57p8-fm3p`, `BIT-pytorch-2026-24747`, `CVE-2026-24747`, `PYSEC-2026-1856`, `PYSEC-2026-2286` · PyPI `torch`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection, Insecure deserialization - [A XStream Security Vulnerability in XML Deserialization in datavane/tis](https://agentprime.io/advisories/CVE-2026-24815.md) `CVE-2026-24815` · CVE record: datavane tis · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2026 · Tags: Unrestricted file upload, Insecure deserialization - [Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector](https://agentprime.io/advisories/GHSA-jmw5-58c7-587h.md) `GHSA-jmw5-58c7-587h`, `CVE-2026-24656` · Maven `org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 3.7 Low · Not analysed yet · Published 26 Jan 2026 · Tags: Insecure deserialization - [Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-15351.md) `CVE-2025-15351` · CVE record: Anritsu VectorStar · CVSS 7.8 High · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-15350.md) `CVE-2025-15350` · CVE record: Anritsu VectorStar · CVSS 7.8 High · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-15348.md) `CVE-2025-15348` · CVE record: Anritsu ShockLine · CVSS 7.8 High · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0773.md) `CVE-2026-0773` · CVE record: Upsonic Upsonic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0772.md) `CVE-2026-0772` · CVE record: Langflow Langflow · CVSS 7.5 High · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0764.md) `CVE-2026-0764` · CVE record: GPT Academic GPT Academic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0763.md) `CVE-2026-0763` · CVE record: GPT Academic GPT Academic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0762.md) `CVE-2026-0762` · CVE record: GPT Academic GPT Academic · CVSS 8.1 High · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0760.md) `CVE-2026-0760` · CVE record: Foundation Agents MetaGPT · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Insecure deserialization - [docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage](https://agentprime.io/advisories/GHSA-vqxf-v2gg-x3hc.md) `GHSA-vqxf-v2gg-x3hc`, `CVE-2026-24009`, `PYSEC-2026-1313` · PyPI `docling-core`: affected `>=2.21.0, <2.48.4`, fixed in `2.48.4` · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69099.md) `CVE-2025-69099` · CVE record: fuelthemes North · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2025-69079.md) `CVE-2025-69079` · CVE record: ThemeREX Sound | Musical Instruments Online Store · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69036.md) `CVE-2025-69036` · CVE record: strongholdthemes Tech Life CPT · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69035.md) `CVE-2025-69035` · CVE record: Strongholdthemes Dental Care CPT · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69002.md) `CVE-2025-69002` · CVE record: designthemes OneLife · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68903.md) `CVE-2025-68903` · CVE record: AivahThemes Anona · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68899.md) `CVE-2025-68899` · CVE record: designthemes Vivagh · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68047.md) `CVE-2025-68047` · CVE record: Arraytics Eventin · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67619.md) `CVE-2025-67619` · CVE record: designthemes Kids Heaven · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67617.md) `CVE-2025-67617` · CVE record: themeton Consult Aid · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-50004.md) `CVE-2025-50004` · CVE record: artbees JupiterX Core · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Insecure deserialization - [Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization](https://agentprime.io/advisories/GHSA-339m-4qw5-j2g3.md) `GHSA-339m-4qw5-j2g3`, `CVE-2026-23946`, `PYSEC-2026-1950` · PyPI `tendenci`: affected `<15.3.12`, fixed in `15.3.12` · CVSS 6.8 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection, Insecure deserialization - [mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport](https://agentprime.io/advisories/GHSA-ggff-9mj3-7246.md) `GHSA-ggff-9mj3-7246`, `CVE-2026-0895`, `PKSA-ykqx-xqdj-9z2x` · Packagist `cpsit/typo3-mailqueue`: affected `<0.4.3 || >=0.5.0, <0.5.1`, fixed in `0.4.3`, `0.5.1` · CVSS 5.2 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Insecure deserialization - [seroval Affected by Remote Code Execution via JSON Deserialization](https://agentprime.io/advisories/GHSA-3rxj-6cgf-8cfw.md) `GHSA-3rxj-6cgf-8cfw`, `CVE-2026-23737` · npm `seroval`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 21 Jan 2026 · Tags: Insecure deserialization - [Laravel Redis Horizontal Scaling Insecure Deserialization](https://agentprime.io/advisories/GHSA-m27r-m6rx-mhm4.md) `GHSA-m27r-m6rx-mhm4`, `CVE-2026-23524`, `PKSA-rh3z-srf7-67z3` · Packagist `laravel/reverb`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jan 2026 · Tags: Insecure deserialization - [Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'](https://agentprime.io/advisories/CVE-2026-0726.md) `CVE-2026-0726` · CVE record: posimyththemes Nexter Extension – Security, Performance, Code Snippets & Site Toolkit · CVSS 8.1 High · Not analysed yet · Published 20 Jan 2026 · Tags: Insecure deserialization - [An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the \`picklefile\` parameter in the \`yacc()\` function.](https://agentprime.io/advisories/CVE-2025-56005.md) `CVE-2025-56005` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 20 Jan 2026 · Tags: Insecure deserialization - [Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE](https://agentprime.io/advisories/CVE-2023-7334.md) `CVE-2023-7334` · CVE record: Changjetong Information Technology Co., Ltd. T+ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2026 · Tags: Insecure deserialization - [Entrust Instant Financial Issuance (IFI) SmartCardController Service .NET Remoting RCE](https://agentprime.io/advisories/CVE-2026-23746.md) `CVE-2026-23746` · CVE record: Entrust Corporation Instant Financial Issuance (IF) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2026 · Tags: Authentication bypass, Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .