https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:36:04.614882+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2024-26542 cnvd-2024-26542 2026-10-09T08:36:04.734565+00:00 cnvd-2024-26542 https://cve.radiocsirt.org/vuln/euvd-2026-159661 EUVD-2026-159661 2026-10-09T08:36:04.734609+00:00 EUVD-2026-159661 https://cve.radiocsirt.org/vuln/fkie_cve-2023-51518 fkie_cve-2023-51518 2026-10-09T08:36:04.734623+00:00

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally.

We recommend users to:  - Upgrade to a non-vulnerable Apache James version

- Run Apache James isolated from other processes (docker - dedicated virtual machine)  - If possible turn off JMX

 https://cve.radiocsirt.org/vuln/ghsa-px7w-c9gw-7gj3 GHSA-px7w-c9gw-7gj3 — Apache James server: Privilege escalation via JMX pre-authentication deserialization 2026-10-09T08:36:04.734659+00:00

Affected: Maven: org.apache.james:james-server

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally.

We recommend users to:  - Upgrade to a non-vulnerable Apache James version

- Run Apache James isolated from other processes (docker - dedicated virtual machine)  - If possible turn off JMX

 https://cve.radiocsirt.org/vuln/gsd-2023-51518 gsd-2023-51518 2026-10-09T08:36:04.734689+00:00 gsd-2023-51518