# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing](https://agentprime.io/advisories/CVE-2026-29109.md) `CVE-2026-29109` · CVE record: SuiteCRM SuiteCRM-Core · CVSS 8.6 High · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE](https://agentprime.io/advisories/CVE-2025-71260.md) `CVE-2025-71260` · CVE record: BMC Software, Inc. FootPrints · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.34 · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25445.md) `CVE-2026-25445` · CVE record: Membership Software WishList Member X · CVSS 8.8 High · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60237.md) `CVE-2025-60237` · CVE record: Themeton Finag · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-60233.md) `CVE-2025-60233` · CVE record: Themeton Zuut · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-27096.md) `CVE-2026-27096` · CVE record: BuddhaThemes ColorFolio - Freelance Designer WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: Insecure deserialization - [OmniGen2-RL Reward Server Unsafe Deserialization RCE](https://agentprime.io/advisories/CVE-2026-25873.md) `CVE-2026-25873` · CVE record: Beijing Academy of Artificial Intelligence (BAAI) OmniGen2-RL · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2026 · Tags: Insecure deserialization - [The mailqueue TYPO3 extension has Insecure Deserialization in \`TransportFailure\` class](https://agentprime.io/advisories/GHSA-2pm6-9fhx-vvg3.md) `GHSA-2pm6-9fhx-vvg3`, `CVE-2026-1323`, `PKSA-nq65-b886-3hc5` · Packagist `cpsit/typo3-mailqueue`: affected `<0.4.5 || >=0.5.0, <0.5.2`, fixed in `0.4.5`, `0.5.2` · CVSS 5.2 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Insecure deserialization - [WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25449.md) `CVE-2026-25449` · CVE record: shinetheme Traveler · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2026 · Tags: Insecure deserialization - [Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-25769.md) `CVE-2026-25769` · CVE record: wazuh wazuh · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Mar 2026 · Tags: Insecure deserialization - [Apache Spark: Spark History Server Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-jwp6-cvj8-fw65.md) `GHSA-jwp6-cvj8-fw65`, `BIT-spark-2025-54920`, `CVE-2025-54920` · Maven `org.apache.spark:spark-core_2.10` and 4 more: affected `<=2.2.3`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 16 Mar 2026 · Tags: Insecure deserialization - [WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-32355.md) `CVE-2026-32355` · CVE record: Crocoblock JetEngine · CVSS 8.8 High · Not analysed yet · Published 13 Mar 2026 · Tags: Insecure deserialization - [Inductive Automation Ignition Software Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2025-13913.md) `CVE-2025-13913` · CVE record: Inductive Automation Ignition Software · CVSS 5.4 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Insecure deserialization - [SGLangs \`replay_request_dump.py\` contains an insecure pickle.load() without validation and proper deserialization](https://agentprime.io/advisories/GHSA-hvwj-8w5g-28rg.md) `GHSA-hvwj-8w5g-28rg`, `CVE-2026-3989`, `PYSEC-2026-3063` · PyPI `sglang`: affected `<0.5.10`, fixed in `0.5.10` · CVSS 7.8 High · Not analysed yet · Published 12 Mar 2026 · Tags: Insecure deserialization - [Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization](https://agentprime.io/advisories/CVE-2026-3967.md) `CVE-2026-3967` · CVE record: Alfresco Activiti · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Insecure deserialization, CWE-20 - [GLPI affected by Remote Code Execution via malicious upload](https://agentprime.io/advisories/CVE-2026-22248.md) `CVE-2026-22248` · CVE record: glpi-project glpi · CVSS 8.1 High · Not analysed yet · Published 11 Mar 2026 · Tags: Insecure deserialization - [Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-2626.md) `CVE-2026-2626` · CVE record: Unknown divi-booster · CVSS 8.1 High · Not analysed yet · Published 11 Mar 2026 · Tags: Cross-site request forgery (CSRF), Insecure deserialization - [Deserialization of untrusted data in Schneider Electric EcoStruxure™ Foxboro DCS](https://agentprime.io/advisories/CVE-2026-1286.md) `CVE-2026-1286` · CVE record: Schneider Electric EcoStruxure™ Foxboro DCS · CVSS 7.0 High · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-26114.md) `CVE-2026-26114` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 1 more · CVSS 8.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-25166.md) `CVE-2026-25166` · CVE record: Microsoft Windows ADK for Windows 10, version 2004 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) and others](https://agentprime.io/advisories/CVE-2025-11739.md) `CVE-2025-11739` · CVE record: Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) and 1 more · CVSS 8.5 High · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration](https://agentprime.io/advisories/CVE-2026-27685.md) `CVE-2026-27685` · CVE record: SAP_SE SAP NetWeaver Enterprise Portal Administration · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.](https://agentprime.io/advisories/CVE-2025-56422.md) `CVE-2025-56422` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: Insecure deserialization - [JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-2020.md) `CVE-2026-2020` · CVE record: skatox JS Archive List · CVSS 7.5 High · Not analysed yet · Published 7 Mar 2026 · Tags: Insecure deserialization - [LangGraph checkpoint loading has unsafe msgpack deserialization](https://agentprime.io/advisories/GHSA-g48c-2wqr-h844.md) `GHSA-g48c-2wqr-h844`, `CVE-2026-28277`, `PYSEC-2026-83` · PyPI `langgraph`: affected `<1.0.10`, fixed in `1.0.10` · CVSS 6.8 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [Avira Internet Security System Speedup Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-27749.md) `CVE-2026-27749` · CVE record: Gen Digital Inc. Avira Internet Security · CVSS 7.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'](https://agentprime.io/advisories/CVE-2026-2599.md) `CVE-2026-2599` · CVE record: crmperks Database for Contact Form 7, WPforms, Elementor forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28105.md) `CVE-2026-28105` · CVE record: ThemeREX Good Energy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-28074.md) `CVE-2026-28074` · CVE record: ThemeREX Pizza House · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27439.md) `CVE-2026-27439` · CVE record: ThemeREX Dentario · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27438.md) `CVE-2026-27438` · CVE record: ThemeREX Kingler · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27437.md) `CVE-2026-27437` · CVE record: ThemeREX Tennis Club · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27417.md) `CVE-2026-27417` · CVE record: SeventhQueen Sweet Date · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27379.md) `CVE-2026-27379` · CVE record: NextScripts NextScripts · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-27369.md) `CVE-2026-27369` · CVE record: BoldThemes Celeste · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-27338.md) `CVE-2026-27338` · CVE record: AivahThemes Car Zone · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability](https://agentprime.io/advisories/CVE-2026-27098.md) `CVE-2026-27098` · CVE record: axiomthemes Au Pair Agency - Babysitting & Nanny Theme · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24385.md) `CVE-2026-24385` · CVE record: gerritvanaaken Podlove Web Player · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-23798.md) `CVE-2026-23798` · CVE record: blubrry PowerPress Podcasting · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22501.md) `CVE-2026-22501` · CVE record: axiomthemes Mounthood · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22497.md) `CVE-2026-22497` · CVE record: AncoraThemes Jardi · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Estate theme <= 1.3.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22475.md) `CVE-2026-22475` · CVE record: axiomthemes Estate · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22474.md) `CVE-2026-22474` · CVE record: ThemeREX Equestrian Centre · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Dental Clinic theme <= 3.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22473.md) `CVE-2026-22473` · CVE record: designthemes Dental Clinic · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Secudeal Payments for Ecommerce plugin <= 1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22471.md) `CVE-2026-22471` · CVE record: maximsecudeal Secudeal Payments for Ecommerce · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22454.md) `CVE-2026-22454` · CVE record: ThemeREX Solaris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22453.md) `CVE-2026-22453` · CVE record: ThemeREX Pets Club · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Handyman theme <= 1.4.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22451.md) `CVE-2026-22451` · CVE record: AncoraThemes Handyman · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-22417.md) `CVE-2026-22417` · CVE record: ThemeGoods Grand Wedding · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2025-54001.md) `CVE-2025-54001` · CVE record: ThemeREX Classter · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Insecure deserialization - [Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20131.md) `CVE-2026-20131` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.44 · Not analysed yet · Published 4 Mar 2026 · Tags: Insecure deserialization - [Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection](https://agentprime.io/advisories/GHSA-gj26-w59c-29mf.md) `GHSA-gj26-w59c-29mf`, `CVE-2026-3452`, `PKSA-79x2-hpny-rxg9` · Packagist `concrete5/concrete5`: affected `<9.4.8`, fixed in `9.4.8` · CVSS 8.9 High · Not analysed yet · Published 4 Mar 2026 · Tags: Insecure deserialization - [An issue in Step-Video-T2V allows a remote attacker to execute arbitrary code via the /vae-api , /caption-api , feature = pickle.loads(request.get_data()) component](https://agentprime.io/advisories/CVE-2025-57622.md) `CVE-2025-57622` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Insecure deserialization - [Qwik vulnerable to Unauthenticated RCE via server$ Deserialization](https://agentprime.io/advisories/GHSA-p9x5-jp3h-96mm.md) `GHSA-p9x5-jp3h-96mm`, `CVE-2026-27971` · npm `@builder.io/qwik`: affected `<1.19.1`, fixed in `1.19.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization - [Chamilo: PHAR deserialization bypass](https://agentprime.io/advisories/CVE-2025-52998.md) `CVE-2025-52998` · CVE record: chamilo chamilo-lms · CVSS 7.0 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization - [Chamilo: Deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters](https://agentprime.io/advisories/CVE-2025-50198.md) `CVE-2025-50198` · CVE record: chamilo chamilo-lms · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization - [Chamilo: Post-Auth Remote Code Execution](https://agentprime.io/advisories/CVE-2024-47886.md) `CVE-2024-47886` · CVE record: chamilo chamilo-lms · CVSS 8.7 High · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization - [e-Excellence｜U-Office Force - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-3422.md) `CVE-2026-3422` · CVE record: e-Excellence U-Office Force · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Insecure deserialization - [WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field](https://agentprime.io/advisories/CVE-2026-2471.md) `CVE-2026-2471` · CVE record: smub WP Mail Logging · CVSS 7.5 High · Not analysed yet · Published 28 Feb 2026 · Tags: Insecure deserialization - [Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-1542.md) `CVE-2026-1542` · CVE record: Unknown Super Stage WP · CVSS 6.5 Medium · Not analysed yet · Published 28 Feb 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .