https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T12:00:44.996047+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2026-28624 cnvd-2026-28624 2026-10-16T12:00:44.998768+00:00 cnvd-2026-28624 https://cve.radiocsirt.org/vuln/euvd-2026-332480 EUVD-2026-332480 2026-10-16T12:00:44.998802+00:00 EUVD-2026-332480 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13759 fkie_cve-2026-13759 2026-10-16T12:00:44.998815+00:00

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs

 https://cve.radiocsirt.org/vuln/ghsa-xw6m-6cgm-v7qm GHSA-xw6m-6cgm-v7qm 2026-10-16T12:00:44.998844+00:00

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs