https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:07:22 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1206 certfr-2026-avi-1206 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1206 https://cve.radiocsirt.org/vuln/euvd-2026-342224 EUVD-2026-342224 https://cve.radiocsirt.org/vuln/euvd-2026-342224 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66713 <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66713 https://cve.radiocsirt.org/vuln/ghsa-fhh8-qfj4-g948 <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> https://cve.radiocsirt.org/vuln/ghsa-fhh8-qfj4-g948 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2540 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Axis2 ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Axis2 ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2540