https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T15:39:15.920760+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-30581 cnvd-2025-30581 2026-10-17T15:39:15.969978+00:00 cnvd-2025-30581 https://cve.radiocsirt.org/vuln/euvd-2026-271283 EUVD-2026-271283 2026-10-17T15:39:15.970016+00:00 EUVD-2026-271283 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64408 fkie_cve-2025-64408 2026-10-17T15:39:15.970031+00:00

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-wq4c-57mh-5f7g GHSA-wq4c-57mh-5f7g — Apache Causeway vulnerable to deserialization in Java 2026-10-17T15:39:15.970066+00:00

Affected: Maven: org.apache.causeway.commons:causeway-commons, Maven: org.apache.causeway.core:causeway-applib, Maven: org.apache.causeway.core:causeway-core, Maven: org.apache.causeway.viewer:causeway-viewer-wicket

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.