https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T10:16:14.278024+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2015-05632 cnvd-2015-05632 2026-10-20T10:16:14.282346+00:00 cnvd-2015-05632 https://cve.radiocsirt.org/vuln/euvd-2026-98016 EUVD-2026-98016 2026-10-20T10:16:14.282377+00:00 EUVD-2026-98016 https://cve.radiocsirt.org/vuln/fkie_cve-2014-1972 fkie_cve-2014-1972 2026-10-20T10:16:14.282391+00:00

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

 https://cve.radiocsirt.org/vuln/ghsa-c438-8cvq-pxxx GHSA-c438-8cvq-pxxx — Apache Tapestry Unsafe Object Storage 2026-10-20T10:16:14.282418+00:00

Affected: Maven: org.apache.tapestry:tapestry-core

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

 https://cve.radiocsirt.org/vuln/gsd-2014-1972 gsd-2014-1972 2026-10-20T10:16:14.282440+00:00 gsd-2014-1972 https://cve.radiocsirt.org/vuln/jvndb-2015-000118 jvndb-2015-000118 2026-10-20T10:16:14.282451+00:00

Apache Tapestry contains a vulnerability where it may deserialize untrusted data. Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the server. This data serialization / deserialization process does not contain data validation. Therefore, if the serialized data is altered, the server will deserailze data without validating the data (CWE-502). Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.