# Insecure deserialization.

Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Microsoft SQL Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-65674.md)
  `CVE-2026-65674` · CVE record: Microsoft Microsoft SQL Server 2019 (GDR) and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool](https://agentprime.io/advisories/CVE-2026-49950.md)
  `CVE-2026-49950` · CVE record: xorbitsai xoscar · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-93905.md)
  `CVE-2026-93905` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 8.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data](https://agentprime.io/advisories/CVE-2026-105442.md)
  `CVE-2026-105442` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Office SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-105013.md)
  `CVE-2026-105013` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-100214.md)
  `CVE-2026-100214` · CVE record: Microsoft Microsoft Dynamics NAV 2017 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Windows Media Foundation Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96186.md)
  `CVE-2026-96186` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-87692.md)
  `CVE-2026-87692` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 2 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Microsoft Office SharePoint Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-85900.md)
  `CVE-2026-85900` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Windows Management Instrumentation Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88091.md)
  `CVE-2026-88091` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2026-65180.md)
  `CVE-2026-65180` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2026-65110.md)
  `CVE-2026-65110` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization](https://agentprime.io/advisories/CVE-2026-108958.md)
  `CVE-2026-108958` · CVE record: TensorLayer · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization, CWE-20
- [yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization](https://agentprime.io/advisories/CVE-2026-108947.md)
  `CVE-2026-108947` · CVE record: yoshitomo-matsubara torchdistill · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization, CWE-20
- [MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path](https://agentprime.io/advisories/CVE-2026-109361.md)
  `CVE-2026-109361` · CVE record: Project-MONAI MONAI · CVSS 7.0 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP](https://agentprime.io/advisories/CVE-2026-109360.md)
  `CVE-2026-109360` · CVE record: Project-MONAI MONAI · CVSS 7.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables](https://agentprime.io/advisories/CVE-2026-109237.md)
  `CVE-2026-109237` · CVE record: unclecode crawl4ai · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API](https://agentprime.io/advisories/CVE-2026-109391.md)
  `CVE-2026-109391` · CVE record: Square Squash · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor](https://agentprime.io/advisories/CVE-2026-12613.md)
  `CVE-2026-12613` · CVE record: Ministry of Justice General Directorate of Information Technology UYAP Document Editor · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [YAML safe_load production fallback to unsafe_load enables RCE via deserialization](https://agentprime.io/advisories/CVE-2026-52903.md)
  `CVE-2026-52903` · CVE record: ManageIQ ManageIQ and 1 more · CVSS 8.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81797.md)
  `CVE-2026-81797` · CVE record: ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78535.md)
  `CVE-2026-78535` · CVE record: ThemeRex Photolia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78533.md)
  `CVE-2026-78533` · CVE record: AncoraThemes Qwery · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78531.md)
  `CVE-2026-78531` · CVE record: ThemeREX Jacqueline · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78529.md)
  `CVE-2026-78529` · CVE record: ThemeREX Alliance · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66569.md)
  `CVE-2026-66569` · CVE record: axiomthemes Kicker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66568.md)
  `CVE-2026-66568` · CVE record: axiomthemes Original · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66567.md)
  `CVE-2026-66567` · CVE record: AncoraThemes Anesta · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66565.md)
  `CVE-2026-66565` · CVE record: axiomthemes FC United · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66564.md)
  `CVE-2026-66564` · CVE record: ThemeREX ShiftCV · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66563.md)
  `CVE-2026-66563` · CVE record: ThemeREX Windsor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66483.md)
  `CVE-2026-66483` · CVE record: ThemeREX Education Center · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66482.md)
  `CVE-2026-66482` · CVE record: AncoraThemes Drone Media · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62130.md)
  `CVE-2026-62130` · CVE record: Amir Helzer WooCommerce Multilingual & Multicurrency · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62125.md)
  `CVE-2026-62125` · CVE record: ThemeREX Asia Garden · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62124.md)
  `CVE-2026-62124` · CVE record: ThemeREX N7 | Golf Club Sports & Events · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62123.md)
  `CVE-2026-62123` · CVE record: ThemeREX Invetex · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62120.md)
  `CVE-2026-62120` · CVE record: ThemeREX Law Office · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62090.md)
  `CVE-2026-62090` · CVE record: ThemeREX WineShop · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62087.md)
  `CVE-2026-62087` · CVE record: ThemeREX Equadio · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62086.md)
  `CVE-2026-62086` · CVE record: ThemeREX Juno · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62077.md)
  `CVE-2026-62077` · CVE record: BoldThemes Avala · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62076.md)
  `CVE-2026-62076` · CVE record: The4 Kalles · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62054.md)
  `CVE-2026-62054` · CVE record: ThemeREX Yacht Rental · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62053.md)
  `CVE-2026-62053` · CVE record: ThemeREX Wine House · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62052.md)
  `CVE-2026-62052` · CVE record: ThemeREX Tipsy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62051.md)
  `CVE-2026-62051` · CVE record: ThemeREX Stargaze · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62050.md)
  `CVE-2026-62050` · CVE record: ThemeREX Splendour · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62021.md)
  `CVE-2026-62021` · CVE record: rascals Angio · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42723.md)
  `CVE-2026-42723` · CVE record: AncoraThemes CleanSkin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42719.md)
  `CVE-2026-42719` · CVE record: Sarah Giles Dynamic User Directory · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42718.md)
  `CVE-2026-42718` · CVE record: Pluggabl Booster for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-42716.md)
  `CVE-2026-42716` · CVE record: payever Payever - WooCommerce Gateway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104398.md)
  `CVE-2026-104398` · CVE record: VillaTheme AFFI – Affiliate Marketing for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62044.md)
  `CVE-2026-62044` · CVE record: bPlugins Super Video Player · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94676.md)
  `CVE-2026-94676` · CVE record: Tainacan Community Tainacan · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105885.md)
  `CVE-2026-105885` · CVE record: 10Web Slider by 10Web · CVSS 8.8 High · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62045.md)
  `CVE-2026-62045` · CVE record: ThemeREX Group Booklovers · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62046.md)
  `CVE-2026-62046` · CVE record: ThemeREX Group Gutentype · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93945.md)
  `CVE-2026-93945` · CVE record: Axiomthemes Balance · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/tag/deserialization.md>
Older: <https://agentprime.io/advisories/tag/deserialization.md?cursor=WyIyMDI2LTEwLTEwVDA3OjAwOjM4LjY3MTAwMFoiLCJDVkUtMjAyNi05Mzk0NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=deserialization&cursor=WyIyMDI2LTEwLTEzVDIwOjQ4OjM4LjAwMDAwMFoiLCJHSFNBLTR3NWYtN2pwMi13NDhnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/deserialization/?cursor=WyIyMDI2LTEwLTEzVDIwOjQ4OjM4LjAwMDAwMFoiLCJHSFNBLTR3NWYtN2pwMi13NDhnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.