agentprime: Insecure deserializationEvery new Insecure deserialization Advisory and CVE.https://agentprime.io/CVE-2026-120859: PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Fileshttps://agentprime.io/advisories/CVE-2026-120859/https://agentprime.io/advisories/CVE-2026-120859/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:14:58 GMTCVECVE-2026-120499: h5io before 0.2.6 Arbitrary Code Execution via read_hdf5https://agentprime.io/advisories/CVE-2026-120499/https://agentprime.io/advisories/CVE-2026-120499/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:55:32 GMTCVECVE-2026-102739: ESPectre: Unsafe Deserialization on .npz dataset leads to Code Executionhttps://agentprime.io/advisories/CVE-2026-102739/https://agentprime.io/advisories/CVE-2026-102739/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:09:12 GMTCVECVE-2026-92190: Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-92190/https://agentprime.io/advisories/CVE-2026-92190/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:50:48 GMTCVEcriticalCVE-2026-118627: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118627/https://agentprime.io/advisories/CVE-2026-118627/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:45:58 GMTCVECVE-2026-118623: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118623/https://agentprime.io/advisories/CVE-2026-118623/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:45:23 GMTCVECVE-2026-115731: Report Deserialization Code Executionhttps://agentprime.io/advisories/CVE-2026-115731/https://agentprime.io/advisories/CVE-2026-115731/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:40:10 GMTCVEcriticalStanza: RCE via pickle deserialization in the lemmatizerhttps://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5/https://agentprime.io/advisories/GHSA-gh9r-c94j-cmp5/stanza >=1.14.0, <1.15.0, fixed in 1.15.0. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:29:16 GMTPyPIstanzaMetalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code executionhttps://agentprime.io/advisories/GHSA-h26j-4vp7-x9w2/https://agentprime.io/advisories/GHSA-h26j-4vp7-x9w2/Metalama.Framework <2025.1.18 || >=2026.0.1-preview, <2026.0.25 || >=2026.1.0-preview, <2026.1.19, fixed in 2025.1.18, 2026.0.25, 2026.1.19. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 03 Nov 2026 16:37:44 GMTNuGetMetalama.FrameworkCVE-2026-120833: labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatchhttps://agentprime.io/advisories/CVE-2026-120833/https://agentprime.io/advisories/CVE-2026-120833/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 00:13:42 GMTCVECVE-2026-102435: Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Fieldhttps://agentprime.io/advisories/CVE-2026-102435/https://agentprime.io/advisories/CVE-2026-102435/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:31:31 GMTCVEcriticalCVE-2026-120320: jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserializationhttps://agentprime.io/advisories/CVE-2026-120320/https://agentprime.io/advisories/CVE-2026-120320/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 01:30:30 GMTCVECVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderhttps://agentprime.io/advisories/CVE-2026-118636/https://agentprime.io/advisories/CVE-2026-118636/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 20:17:11 GMTCVEcriticalCVE-2026-109220: PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Fieldhttps://agentprime.io/advisories/CVE-2026-109220/https://agentprime.io/advisories/CVE-2026-109220/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 06:44:14 GMTCVEcriticalCVE-2026-63393: OpenSearch SQL plugin: Unsafe cursor deserialization permits server code executionhttps://agentprime.io/advisories/CVE-2026-63393/https://agentprime.io/advisories/CVE-2026-63393/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:22:05 GMTCVECVE-2026-118938: Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysishttps://agentprime.io/advisories/CVE-2026-118938/https://agentprime.io/advisories/CVE-2026-118938/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:19:13 GMTCVECVE-2026-16760: Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callableshttps://agentprime.io/advisories/CVE-2026-16760/https://agentprime.io/advisories/CVE-2026-16760/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:16:31 GMTCVECVE-2026-118090: WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118090/https://agentprime.io/advisories/CVE-2026-118090/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:57 GMTCVECVE-2026-118089: WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118089/https://agentprime.io/advisories/CVE-2026-118089/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:56 GMTCVECVE-2026-90888: WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-90888/https://agentprime.io/advisories/CVE-2026-90888/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:41 GMTCVEcriticalCVE-2026-78527: WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-78527/https://agentprime.io/advisories/CVE-2026-78527/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:40 GMTCVECVE-2026-73186: WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-73186/https://agentprime.io/advisories/CVE-2026-73186/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:39 GMTCVECVE-2026-39738: WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-39738/https://agentprime.io/advisories/CVE-2026-39738/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:34 GMTCVEcriticalCVE-2026-119526: WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-119526/https://agentprime.io/advisories/CVE-2026-119526/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 18:30:31 GMTCVEcriticalCVE-2026-61803: Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amounthttps://agentprime.io/advisories/CVE-2026-61803/https://agentprime.io/advisories/CVE-2026-61803/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 16:50:08 GMTCVECVE-2026-119706: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserializationhttps://agentprime.io/advisories/CVE-2026-119706/https://agentprime.io/advisories/CVE-2026-119706/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:16:07 GMTCVEcriticalCVE-2026-93327: Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-93327/https://agentprime.io/advisories/CVE-2026-93327/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:56:39 GMTCVEcriticalCVE-2026-45145: Chamilo LMS: Database-backed PHP object injection in career deserializationhttps://agentprime.io/advisories/CVE-2026-45145/https://agentprime.io/advisories/CVE-2026-45145/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 14:29:05 GMTCVECVE-2026-103039: Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Fieldhttps://agentprime.io/advisories/CVE-2026-103039/https://agentprime.io/advisories/CVE-2026-103039/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 06:47:32 GMTCVEcriticalCVE-2026-114422: Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacerhttps://agentprime.io/advisories/CVE-2026-114422/https://agentprime.io/advisories/CVE-2026-114422/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 06:00:22 GMTCVECVE-2026-118562: Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275https://agentprime.io/advisories/CVE-2026-118562/https://agentprime.io/advisories/CVE-2026-118562/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 03:08:50 GMTCVECVE-2026-107238: Deserialization of untrusted data in Veeam Management Pack for Microsoft System Centerhttps://agentprime.io/advisories/CVE-2026-107238/https://agentprime.io/advisories/CVE-2026-107238/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 22:55:37 GMTCVECVE-2023-22793: Deserialization of untrusted data in Veeam Management Pack for Microsoft System Centerhttps://agentprime.io/advisories/CVE-2023-22793/https://agentprime.io/advisories/CVE-2023-22793/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 22:55:37 GMTCVEcriticalCVE-2026-119120: Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_namehttps://agentprime.io/advisories/CVE-2026-119120/https://agentprime.io/advisories/CVE-2026-119120/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:04 GMTCVECVE-2026-118081: WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118081/https://agentprime.io/advisories/CVE-2026-118081/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:38 GMTCVECVE-2026-118080: WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118080/https://agentprime.io/advisories/CVE-2026-118080/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:38 GMTCVECVE-2026-118079: WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118079/https://agentprime.io/advisories/CVE-2026-118079/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:37 GMTCVECVE-2026-118078: WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118078/https://agentprime.io/advisories/CVE-2026-118078/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:36 GMTCVECVE-2026-118077: WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118077/https://agentprime.io/advisories/CVE-2026-118077/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:35 GMTCVECVE-2026-118076: WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118076/https://agentprime.io/advisories/CVE-2026-118076/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:35 GMTCVECVE-2026-118075: WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118075/https://agentprime.io/advisories/CVE-2026-118075/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:34 GMTCVECVE-2026-118074: WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118074/https://agentprime.io/advisories/CVE-2026-118074/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:33 GMTCVECVE-2026-118073: WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118073/https://agentprime.io/advisories/CVE-2026-118073/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:32 GMTCVECVE-2026-116869: WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116869/https://agentprime.io/advisories/CVE-2026-116869/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:32 GMTCVECVE-2026-116868: WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116868/https://agentprime.io/advisories/CVE-2026-116868/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:31 GMTCVECVE-2026-116867: WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116867/https://agentprime.io/advisories/CVE-2026-116867/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:30 GMTCVECVE-2026-116866: WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116866/https://agentprime.io/advisories/CVE-2026-116866/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:29 GMTCVECVE-2026-116865: WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116865/https://agentprime.io/advisories/CVE-2026-116865/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:29 GMTCVECVE-2026-116864: WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-116864/https://agentprime.io/advisories/CVE-2026-116864/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:28 GMTCVECVE-2026-62131: WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerabilityhttps://agentprime.io/advisories/CVE-2026-62131/https://agentprime.io/advisories/CVE-2026-62131/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:24:26 GMTCVEcritical