# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Kiteworks Email Protection Gateway deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-102108.md) `CVE-2026-102108` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [Kiteworks Email Protection Gateway Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-102135.md) `CVE-2026-102135` · CVE record: Kiteworks Email Protection Gateway · CVSS 6.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [Kiteworks Core deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-102101.md) `CVE-2026-102101` · CVE record: Kiteworks Core · CVSS 8.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-102392.md) `CVE-2026-102392` · CVE record: ThemeHigh Extra Product Options For WooCommerce | Custom Product Addons and Fields · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-102377.md) `CVE-2026-102377` · CVE record: 10Web Photo Gallery by 10Web · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-100512.md) `CVE-2026-100512` · CVE record: Hook & Filter Nested Pages · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97291.md) `CVE-2026-97291` · CVE record: Magazine3 Schema & Structured Data for WP & AMP · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97256.md) `CVE-2026-97256` · CVE record: Greg – SiteOrigin Page Builder by SiteOrigin · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing](https://agentprime.io/advisories/CVE-2026-103441.md) `CVE-2026-103441` · CVE record: The Wikimedia Foundation MediaWiki Wikibase extension · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service](https://agentprime.io/advisories/CVE-2026-103395.md) `CVE-2026-103395` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97248.md) `CVE-2026-97248` · CVE record: Booking Activities Team Booking Activities · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97246.md) `CVE-2026-97246` · CVE record: ShortPixel ShortPixel Image Optimizer · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96833.md) `CVE-2026-96833` · CVE record: Themefic Ultimate Addons for Contact Form 7 · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96832.md) `CVE-2026-96832` · CVE record: keywordrush Content Egg · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96831.md) `CVE-2026-96831` · CVE record: themifyme Themify Builder · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96344.md) `CVE-2026-96344` · CVE record: impleCode eCommerce Product Catalog · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96343.md) `CVE-2026-96343` · CVE record: weDevs WP ERP · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95531.md) `CVE-2026-95531` · CVE record: QuantumCloud Conversational Forms for ChatBot · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94683.md) `CVE-2026-94683` · CVE record: Justin Nealey DesignSetGo · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94678.md) `CVE-2026-94678` · CVE record: Mat Lipe Go Live Update Urls · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94677.md) `CVE-2026-94677` · CVE record: Nexcess Kadence WooCommerce Email Designer · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94122.md) `CVE-2026-94122` · CVE record: A WP Life Responsive Slider Gallery · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94121.md) `CVE-2026-94121` · CVE record: 10Web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94076.md) `CVE-2026-94076` · CVE record: SEO Squirrly SEO Plugin by Squirrly SEO · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93771.md) `CVE-2026-93771` · CVE record: WPFactory Cost of Goods for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93651.md) `CVE-2026-93651` · CVE record: Dotstore Minimum and Maximum Quantity for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93624.md) `CVE-2026-93624` · CVE record: codepeople Music Player for WooCommerce · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [DigiWin｜EasyFlow .NET - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-102455.md) `CVE-2026-102455` · CVE record: DigiWin EasyFlow .NET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta](https://agentprime.io/advisories/CVE-2026-91051.md) `CVE-2026-91051` · CVE record: Unknown EWWW Image Optimizer · CVSS 6.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization - [Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-13046.md) `CVE-2026-13046` · CVE record: WatchGuard Fireware OS · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization - [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service](https://agentprime.io/advisories/CVE-2026-103041.md) `CVE-2026-103041` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization - [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service](https://agentprime.io/advisories/CVE-2026-103040.md) `CVE-2026-103040` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization - [GluonTS arbitrary command execution during model deserialization](https://agentprime.io/advisories/CVE-2026-100308.md) `CVE-2026-100308` · CVE record: AWS gluonts · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, Insecure deserialization - [Deserialization of untrusted data in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-101169.md) `CVE-2026-101169` · CVE record: Octopus Deploy Octopus Server · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization - [jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)](https://agentprime.io/advisories/GHSA-gx83-3vf8-gh7j.md) `GHSA-gx83-3vf8-gh7j`, `CVE-2026-83557` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.11.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2`, fixed in `2.18.10`, `2.21.6`, `2.22.2` · CVSS 5.6 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization, Broken access control - [Deserialization of Untrusted Data in Application Integration allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-81867.md) `CVE-2026-81867` · CVE record: Google Cloud Application Integration · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization - [Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint](https://agentprime.io/advisories/CVE-2026-82384.md) `CVE-2026-82384` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization - [Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options](https://agentprime.io/advisories/CVE-2026-86841.md) `CVE-2026-86841` · CVE record: Unknown Online Scheduling and Appointment Booking System · CVSS 4.7 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Insecure deserialization - [In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in ...](https://agentprime.io/advisories/GHSA-636w-j999-g7x5.md) `GHSA-636w-j999-g7x5`, `CVE-2026-100841`, `PYSEC-2026-4016` · PyPI `monai`: affected , no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 27 Sept 2026 · Tags: Insecure deserialization - [langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization](https://agentprime.io/advisories/CVE-2026-97869.md) `CVE-2026-97869` · CVE record: langchain4j · CVSS 2.1 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Insecure deserialization, CWE-20 - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84862.md) `CVE-2026-84862` · CVE record: IBM Guardium Data Protection · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: Insecure deserialization - [Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization](https://agentprime.io/advisories/CVE-2026-97865.md) `CVE-2026-97865` · CVE record: Open-Web-Analytics · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Insecure deserialization, CWE-20 - [yara-x: Unvalidated deserialization in safe \`Rules::deserialize\` allows memory corruption and UB](https://agentprime.io/advisories/GHSA-2jx3-ff3v-j7jj.md) `GHSA-2jx3-ff3v-j7jj` · crates.io `yara-x`: affected `<1.19.0`, fixed in `1.19.0` · CVSS 4.0, no score published · Not analysed yet · Published 24 Sept 2026 · Tags: Insecure deserialization - [PHP object injection via unsuppressible \_\_pclass class inference in command monitoring events](https://agentprime.io/advisories/CVE-2026-96745.md) `CVE-2026-96745` · CVE record: MongoDB PHP Driver · CVSS 6.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Insecure deserialization - [BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests](https://agentprime.io/advisories/CVE-2026-63630.md) `CVE-2026-63630` · CVE record: alam00000 bentopdf · CVSS 3.4 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Insecure deserialization - [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-82093.md) `CVE-2026-82093` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Insecure deserialization - [wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields](https://agentprime.io/advisories/CVE-2026-80513.md) `CVE-2026-80513` · CVE record: Unknown wpForo Forum · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Insecure deserialization - [WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95603.md) `CVE-2026-95603` · CVE record: Victor Rodriguez Reycob Product Import Export · CVSS 7.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization - [CVE-2026-96804](https://agentprime.io/advisories/CVE-2026-96804.md) `CVE-2026-96804` · CVE record: MLflow MLflow · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization - [MLflow dspy bypasses pickle deserialization control](https://agentprime.io/advisories/CVE-2026-96775.md) `CVE-2026-96775` · CVE record: MLflow MLflow · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18490.md) `CVE-2026-18490` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization - [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel](https://agentprime.io/advisories/CVE-2026-96560.md) `CVE-2026-96560` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization - [recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization](https://agentprime.io/advisories/CVE-2026-95928.md) `CVE-2026-95928` · CVE record: recommenders-team recommenders · CVSS 5.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization, CWE-20 - [Dask Loader core.py from_npy_stack deserialization](https://agentprime.io/advisories/CVE-2026-95897.md) `CVE-2026-95897` · CVE record: Dask · CVSS 5.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization, CWE-20 - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18163.md) `CVE-2026-18163` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17637.md) `CVE-2026-17637` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization - [openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker](https://agentprime.io/advisories/CVE-2026-67615.md) `CVE-2026-67615` · CVE record: Apereo Foundation openEQUELLA · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization, CWE-184 - [SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-28325.md) `CVE-2026-28325` · CVE record: SolarWinds Observability Self-Hosted · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization - [Softaculous Virtualizor PHP Object Injection via Billing Module Handler](https://agentprime.io/advisories/CVE-2026-43642.md) `CVE-2026-43642` · CVE record: Softaculous Virtualizor · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization - [Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE](https://agentprime.io/advisories/CVE-2026-83603.md) `CVE-2026-83603` · CVE record: netdata netdata · CVSS 8.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .