# Insecure deserialization. Untrusted data turned back into objects, often leading to code execution. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Next.js: Unauthenticated Remote Code Execution in \`use cache\` functions returning typed arrays](https://agentprime.io/advisories/GHSA-673q-mjm6-r5xr.md) `GHSA-673q-mjm6-r5xr` · npm `next`: affected `>=16.0.0, <16.4.1`, fixed in `16.4.1` · CVSS 4.0, no score published · Not analysed yet · Published 22 Oct 2026 · Tags: Insecure deserialization - [Insecure Deserialization of .cleanshot Files in CleanShot X](https://agentprime.io/advisories/CVE-2026-16477.md) `CVE-2026-16477` · CVE record: MTW CleanShot X · CVSS 8.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114724.md) `CVE-2026-114724` · CVE record: Roundcube Webmail · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Insecure deserialization - [TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization](https://agentprime.io/advisories/CVE-2026-29001.md) `CVE-2026-29001` · CVE record: tastyigniter TastyIgniter · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission](https://agentprime.io/advisories/CVE-2026-113779.md) `CVE-2026-113779` · CVE record: pfrest pfSense-pkg-RESTAPI · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load](https://agentprime.io/advisories/CVE-2026-114403.md) `CVE-2026-114403` · CVE record: PHPOffice PHPPresentation · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110369.md) `CVE-2026-110369` · CVE record: GS Plugins WordPress Team Members – GS Plugins · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110370.md) `CVE-2026-110370` · CVE record: GS Plugins GS Pins for Pinterest · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-82814.md) `CVE-2026-82814` · CVE record: smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in floss](https://agentprime.io/advisories/CVE-2026-114198.md) `CVE-2026-114198` · CVE record: Mandiant FLARE floss · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in capa](https://agentprime.io/advisories/CVE-2026-114197.md) `CVE-2026-114197` · CVE record: Mandiant FLARE capa · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91483.md) `CVE-2026-91483` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91460.md) `CVE-2026-91460` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91459.md) `CVE-2026-91459` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-91333.md) `CVE-2026-91333` · CVE record: Oracle Corporation Oracle Java SE · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [Apache CouchDB: Atom-table exhaustion in \_changes sequences and \_search bookmarks with specially crafted sequence values](https://agentprime.io/advisories/CVE-2026-90799.md) `CVE-2026-90799` · CVE record: Apache Software Foundation Apache CouchDB · CVSS 1.3 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition](https://agentprime.io/advisories/CVE-2026-113356.md) `CVE-2026-113356` · CVE record: DokuWiki DokuWiki · CVSS 7.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [Uniong｜WebITR - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-113404.md) `CVE-2026-113404` · CVE record: Uniong WebITR · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization - [IBM MQ Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-12148.md) `CVE-2026-12148` · CVE record: IBM MQ Operator and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [IBM MQ Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-12155.md) `CVE-2026-12155` · CVE record: IBM MQ Operator and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [IBM MQ Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-12350.md) `CVE-2026-12350` · CVE record: IBM MQ Operator and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()](https://agentprime.io/advisories/CVE-2026-112304.md) `CVE-2026-112304` · CVE record: Mindee docTR · CVSS 7.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-88900.md) `CVE-2026-88900` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads](https://agentprime.io/advisories/CVE-2026-78165.md) `CVE-2026-78165` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)](https://agentprime.io/advisories/CVE-2026-78162.md) `CVE-2026-78162` · CVE record: Apache Software Foundation Apache Camel · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111408.md) `CVE-2026-111408` · CVE record: ExpressTech Quiz And Survey Master · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization - [ESPnet Inference Model inference_model.py build_model deserialization](https://agentprime.io/advisories/CVE-2026-112086.md) `CVE-2026-112086` · CVE record: ESPnet · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization](https://agentprime.io/advisories/CVE-2026-112081.md) `CVE-2026-112081` · CVE record: hankcs HanLP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization](https://agentprime.io/advisories/CVE-2026-112079.md) `CVE-2026-112079` · CVE record: hankcs HanLP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-107436.md) `CVE-2026-107436` · CVE record: WP Chill Strong Testimonials · CVSS 8.8 High · Not analysed yet · Published 18 Oct 2026 · Tags: Insecure deserialization - [WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110886.md) `CVE-2026-110886` · CVE record: QuantumCloud Conversational Forms for ChatBot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Insecure deserialization - [datastax pulsar-jms PulsarObjectMessage.java decode deserialization](https://agentprime.io/advisories/CVE-2026-111868.md) `CVE-2026-111868` · CVE record: datastax pulsar-jms · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Insecure deserialization, CWE-20 - [Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection](https://agentprime.io/advisories/CVE-2026-81344.md) `CVE-2026-81344` · CVE record: Unknown ACF Frontend Admin by DynamiApps · CVSS 6.6 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Insecure deserialization - [LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter](https://agentprime.io/advisories/CVE-2026-104736.md) `CVE-2026-104736` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Insecure deserialization - [Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import](https://agentprime.io/advisories/CVE-2026-104734.md) `CVE-2026-104734` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Insecure deserialization - [LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport](https://agentprime.io/advisories/GHSA-w5f2-9q9c-ff4h.md) `GHSA-w5f2-9q9c-ff4h`, `CVE-2026-105192` · PyPI `lmcache`: affected `>=0.3.9, <0.5.6`, fixed in `0.5.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Insecure deserialization - [10up Distributor before 2.3.2 PHP Object Injection via set_meta()](https://agentprime.io/advisories/CVE-2026-111628.md) `CVE-2026-111628` · CVE record: 10up Distributor · CVSS 2.3 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization - [Apache Kylin: Redis unsafe Java deserialization](https://agentprime.io/advisories/CVE-2026-64610.md) `CVE-2026-64610` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization - [WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97296.md) `CVE-2026-97296` · CVE record: Rocketgenius, Inc Gravity Forms · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization - [Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter](https://agentprime.io/advisories/CVE-2026-104730.md) `CVE-2026-104730` · CVE record: sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization - [Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption](https://agentprime.io/advisories/CVE-2026-104932.md) `CVE-2026-104932` · CVE record: johnny5 Search Regex · CVSS 8.0 High · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Lenovo Legion Zone Application](https://agentprime.io/advisories/CVE-2026-75941.md) `CVE-2026-75941` · CVE record: Lenovo Legion Zone Application · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization](https://agentprime.io/advisories/CVE-2026-111160.md) `CVE-2026-111160` · CVE record: ModelTC LightLLM · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()](https://agentprime.io/advisories/CVE-2026-110874.md) `CVE-2026-110874` · CVE record: Dolibarr dolibarr · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox](https://agentprime.io/advisories/CVE-2026-47218.md) `CVE-2026-47218` · CVE record: containerd runwasi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune](https://agentprime.io/advisories/CVE-2026-110812.md) `CVE-2026-110812` · CVE record: AWS Amazon Neptune Engine · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF) - [Deserialization of untrusted data in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-111094.md) `CVE-2026-111094` · CVE record: JetBrains TeamCity · CVSS 8.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params](https://agentprime.io/advisories/CVE-2026-47168.md) `CVE-2026-47168` · CVE record: espocrm espocrm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109686.md) `CVE-2026-109686` · CVE record: Link Whisper INC Link Whisper Free · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [Deserialization of untrusted data in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-102469.md) `CVE-2026-102469` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization - [ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import](https://agentprime.io/advisories/CVE-2026-110761.md) `CVE-2026-110761` · CVE record: ILIAS-eLearning e.V. ILIAS · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain](https://agentprime.io/advisories/CVE-2026-55573.md) `CVE-2026-55573` · CVE record: e107inc e107 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-108291.md) `CVE-2026-108291` · CVE record: itthinx Affiliates · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-106599.md) `CVE-2026-106599` · CVE record: Brainstorm Force SureCart · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97278.md) `CVE-2026-97278` · CVE record: WP SYNTEX Polylang · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [HPE NonStop Middleware - Secret key handling vulnerability](https://agentprime.io/advisories/CVE-2026-73793.md) `CVE-2026-73793` · CVE record: Hewlett Packard Enterprise HPE NonStop Middleware · CVSS 7.9 High · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data\[meta\]' Parameter](https://agentprime.io/advisories/CVE-2026-104764.md) `CVE-2026-104764` · CVE record: wpazleen Post Export Import with Media · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization - [Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-4j9v-h7pp-725h.md) `GHSA-4j9v-h7pp-725h`, `CVE-2026-70035` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization - [Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-c27m-942f-rcfh.md) `GHSA-c27m-942f-rcfh`, `CVE-2026-87697` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization - [Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-4w5f-7jp2-w48g.md) `GHSA-4w5f-7jp2-w48g`, `CVE-2026-83520` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .