# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SvelteKit has deserialization expansion in unvalidated \`form\` remote function leading to Denial of Service (experimental only)](https://agentprime.io/advisories/GHSA-fpg4-jhqr-589c.md) `GHSA-fpg4-jhqr-589c`, `CVE-2026-82259` · npm `@sveltejs/kit`: affected `>=2.49.0, <2.53.3`, fixed in `2.53.3` · CVSS 8.7 High · Not analysed yet · Published 28 Feb 2026 · Tags: Insecure deserialization, Denial of service - [Unsafe Deserialization of Erlang Terms in hex_core](https://agentprime.io/advisories/GHSA-hx9w-f2w9-9g96.md) `GHSA-hx9w-f2w9-9g96`, `CVE-2026-21619`, `EEF-CVE-2026-21619` · Hex `hex_core`: affected `>=0.1.0, <0.12.1`, fixed in `0.12.1` · CVSS 2.0 Low · Not analysed yet · Published 27 Feb 2026 · Tags: Denial of service, Insecure deserialization - [Deserialization of untrusted data in NTT DATA INTRAMART Corporation intra-mart Accel Platform](https://agentprime.io/advisories/CVE-2026-27776.md) `CVE-2026-27776` · CVE record: NTT DATA INTRAMART Corporation intra-mart Accel Platform · CVSS 8.6 High · Not analysed yet · Published 27 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Flair](https://agentprime.io/advisories/CVE-2026-3071.md) `CVE-2026-3071` · CVE record: Flair Flair · CVSS 8.4 High · Not analysed yet · Published 26 Feb 2026 · Tags: Insecure deserialization - [WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28138.md) `CVE-2026-28138` · CVE record: Stylemix uListing · CVSS 7.2 High · Not analysed yet · Published 26 Feb 2026 · Tags: Insecure deserialization - [LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-mhr3-j7m5-c7c9.md) `GHSA-mhr3-j7m5-c7c9`, `CVE-2026-27794`, `PYSEC-2026-2574` · PyPI `langgraph-checkpoint`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.6 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Insecure deserialization - [c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property](https://agentprime.io/advisories/GHSA-5476-xc4j-rqcv.md) `GHSA-5476-xc4j-rqcv`, `CVE-2026-27830` · Maven `com.mchange:c3p0`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 8.9 High · Not analysed yet · Published 25 Feb 2026 · Tags: Code injection, Insecure deserialization - [mchange-commons-java: Remote Code Execution via JNDI Reference Resolution](https://agentprime.io/advisories/GHSA-m2cm-222f-qw44.md) `GHSA-m2cm-222f-qw44`, `CVE-2026-27727` · Maven `com.mchange:mchange-commons-java`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 8.9 High · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, Insecure deserialization - [DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE](https://agentprime.io/advisories/CVE-2026-26222.md) `CVE-2026-26222` · CVE record: Beyond Limits Inc. Altec DocLink · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF) - [Deserialization of untrusted data in Fiserv Originate Loans Peripherals (formerly Velocity Services) -- Print…](https://agentprime.io/advisories/CVE-2026-21665.md) `CVE-2026-21665` · CVE record: Fiserv Originate Loans Peripherals (formerly Velocity Services) -- Print Service component · CVSS 7.7 High · Not analysed yet · Published 23 Feb 2026 · Tags: Insecure deserialization - [Apache Camel Deserializes Untrusted Data in its LevelDB Component](https://agentprime.io/advisories/GHSA-429q-mrc4-38fr.md) `GHSA-429q-mrc4-38fr`, `CVE-2026-25747` · Maven `org.apache.camel:camel-leveldb`: affected `>=3.0.0, <4.10.9 || >=4.11.0, <4.14.5 || >=4.15.0, <4.18.0`, fixed in `4.10.9`, `4.14.5`, `4.18.0` · CVSS 8.8 High · Not analysed yet · Published 23 Feb 2026 · Tags: Insecure deserialization - [datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache](https://agentprime.io/advisories/GHSA-hg58-x52p-859c.md) `GHSA-hg58-x52p-859c`, `CVE-2026-2970`, `PYSEC-2026-2438` · PyPI `datapizza-ai-core`: affected `<=0.0.7`, no fixed version yet · CVSS 2.1 Low · Not analysed yet · Published 23 Feb 2026 · Tags: Insecure deserialization, CWE-20 - [funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function](https://agentprime.io/advisories/GHSA-gcxp-xg77-798j.md) `GHSA-gcxp-xg77-798j`, `CVE-2026-2898`, `PKSA-rzcm-2t96-zr56` · Packagist `funadmin/funadmin`: affected `<=7.1.0-rc4`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: Insecure deserialization, CWE-20 - [GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-2036.md) `CVE-2026-2036` · CVE record: GFI Archiver · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-2037.md) `CVE-2026-2037` · CVE record: GFI Archiver · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling](https://agentprime.io/advisories/CVE-2026-24892.md) `CVE-2026-24892` · CVE record: openITCOCKPIT openITCOCKPIT · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection](https://agentprime.io/advisories/CVE-2026-24891.md) `CVE-2026-24891` · CVE record: openITCOCKPIT openITCOCKPIT · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22384.md) `CVE-2026-22384` · CVE record: leafcolor Applay - Shortcodes · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22354.md) `CVE-2026-22354` · CVE record: Dotstore Woocommerce Category Banner Management · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22346.md) `CVE-2026-22346` · CVE record: A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22345.md) `CVE-2026-22345` · CVE record: A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69405.md) `CVE-2025-69405` · CVE record: ThemeREX Lorem Ipsum | Books & Media Store · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69404.md) `CVE-2025-69404` · CVE record: ThemeREX Extreme Store · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69382.md) `CVE-2025-69382` · CVE record: themesflat Themesflat Elementor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69372.md) `CVE-2025-69372` · CVE record: AncoraThemes SevenHills · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69371.md) `CVE-2025-69371` · CVE record: AncoraThemes KindlyCare · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69370.md) `CVE-2025-69370` · CVE record: ThemeGoods Capella · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69329.md) `CVE-2025-69329` · CVE record: Jthemes Prestige · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69328.md) `CVE-2025-69328` · CVE record: magepeopleteam Booking and Rental Manager · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69301.md) `CVE-2025-69301` · CVE record: ThemeGoods PhotoMe · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-69294.md) `CVE-2025-69294` · CVE record: fuelthemes PeakShops · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68853.md) `CVE-2025-68853` · CVE record: Kleor Contact Manager · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68541.md) `CVE-2025-68541` · CVE record: BoldThemes Ippsum · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68531.md) `CVE-2025-68531` · CVE record: modeltheme ModelTheme Addons for WPBakery and Elementor · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-68526.md) `CVE-2025-68526` · CVE record: A WP Life Modal Popup Box · CVSS 8.8 High · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67997.md) `CVE-2025-67997` · CVE record: BoldThemes Travelicious · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67996.md) `CVE-2025-67996` · CVE record: BoldThemes Nestin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-67995.md) `CVE-2025-67995` · CVE record: LoftOcean PatioTime · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: Insecure deserialization - [Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()](https://agentprime.io/advisories/GHSA-v7m3-fpcr-h7m2.md) `GHSA-v7m3-fpcr-h7m2`, `CVE-2026-27206`, `PKSA-zhg7-9xn9-qv5j` · Packagist `zumba/json-serializer`: affected `<3.2.3`, fixed in `3.2.3` · CVSS 8.1 High · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25316.md) `CVE-2026-25316` · CVE record: Brainstorm Force CartFlows · CVSS 7.2 High · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-23549.md) `CVE-2026-23549` · CVE record: magepeopleteam WpEvently · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-23544.md) `CVE-2026-23544` · CVE record: codetipi Valenti · CVSS 8.8 High · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-23542.md) `CVE-2026-23542` · CVE record: ThemeGoods Grand Restaurant · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [WordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-22333.md) `CVE-2026-22333` · CVE record: YITHEMES YITH WooCommerce Compare · CVSS 7.2 High · Not analysed yet · Published 19 Feb 2026 · Tags: Insecure deserialization - [NVIDIA NeMo Framework Deserializes Untrusted Data](https://agentprime.io/advisories/GHSA-hvjw-vp7g-39h5.md) `GHSA-hvjw-vp7g-39h5`, `CVE-2025-33253`, `PYSEC-2026-2673` · PyPI `nemo-toolkit`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution](https://agentprime.io/advisories/GHSA-9379-mwvr-7wxx.md) `GHSA-9379-mwvr-7wxx`, `CVE-2025-33245`, `PYSEC-2026-2672` · PyPI `nemo-toolkit`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 8.0 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [An Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.](https://agentprime.io/advisories/CVE-2025-15579.md) `CVE-2025-15579` · CVE record: OpenText™ Directory Services · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility](https://agentprime.io/advisories/CVE-2026-1426.md) `CVE-2026-1426` · CVE record: berocket Advanced AJAX Product Filters · CVSS 8.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Bosch Rexroth IndraWorks](https://agentprime.io/advisories/CVE-2025-60038.md) `CVE-2025-60038` · CVE record: Bosch Rexroth IndraWorks · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Bosch Rexroth IndraWorks](https://agentprime.io/advisories/CVE-2025-60037.md) `CVE-2025-60037` · CVE record: Bosch Rexroth IndraWorks · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Bosch Rexroth IndraWorks and others](https://agentprime.io/advisories/CVE-2025-60036.md) `CVE-2025-60036` · CVE record: Bosch Rexroth IndraWorks and 1 more · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Bosch Rexroth IndraWorks](https://agentprime.io/advisories/CVE-2025-60035.md) `CVE-2025-60035` · CVE record: Bosch Rexroth IndraWorks · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33252.md) `CVE-2025-33252` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33243.md) `CVE-2025-33243` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33241.md) `CVE-2025-33241` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 18 Feb 2026 · Tags: Insecure deserialization - [LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE](https://agentprime.io/advisories/CVE-2026-26220.md) `CVE-2026-26220` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Feb 2026 · Tags: Insecure deserialization - [JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization](https://agentprime.io/advisories/CVE-2026-2555.md) `CVE-2026-2555` · CVE record: JeecgBoot · CVSS 2.3 Low · Not analysed yet · Published 16 Feb 2026 · Tags: Insecure deserialization, CWE-20 - [Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE](https://agentprime.io/advisories/CVE-2026-26333.md) `CVE-2026-26333` · CVE record: Calero VeraSMART · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2026 · Tags: Authentication bypass, Insecure deserialization - [ADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-26208.md) `CVE-2026-26208` · CVE record: Alex4SSB ADB-Explorer · CVSS 7.8 High · Not analysed yet · Published 13 Feb 2026 · Tags: Insecure deserialization - [Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE](https://agentprime.io/advisories/CVE-2026-26221.md) `CVE-2026-26221` · CVE record: Hyland OnBase Workflow Timer Service · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .