https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:40:06.094027+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-tk74523 CLEANSTART-2026-TK74523 — Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, wi… 2026-10-03T08:40:06.146319+00:00

Affected: CleanStart: wildfly

Security vulnerability affects the wildfly package. Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place.

 https://cve.radiocsirt.org/vuln/euvd-2026-349186 EUVD-2026-349186 2026-10-03T08:40:06.146373+00:00 EUVD-2026-349186 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66909 fkie_cve-2026-66909 2026-10-03T08:40:06.146390+00:00

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/ghsa-gvw8-rcrx-9fxx GHSA-gvw8-rcrx-9fxx 2026-10-03T08:40:06.146417+00:00

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

 https://cve.radiocsirt.org/vuln/rhsa-2026:71675 RHSA-2026:71675 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release. 2026-10-03T08:40:06.146436+00:00

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects camel-jms: camel-sjms: camel-amqp: camel-mina: camel-netty: camel-netty-http: camel-vertx-http: camel-infinispan: camel-leveldb: camel-cassandraql: camel-consul: camel-sql: Apache Camel: Information disclosure via deserialization of untrusted data camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation org.apache.cxf/cxf:…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2682 WID-SEC-W-2026-2682 — Apache CXF: Mehrere Schwachstellen 2026-10-03T08:40:06.146506+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.