EUVD-2026-93970

Symbolic name not mapping to correct object vulnerability in Apache Commons. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue...

CVE-2026-94114

Apache Commons BCEL versions before 6.13.0 are vulnerable to a symbolic name mapping issue. The BCEL component caches attacker-controlled classes using self-declared names without sufficient validation. This flaw allows subsequent lookups and name-keyed verification results to point to different ...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

xwiki__xwiki-commons_CVE-2023-36471_14-10-5

XWiki Commons XWiki Commons are technical libraries common to several other top level XWiki projects. These libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org...

PT-2026-107178

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0 Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. This occurs when...

PT-2026-107219

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0 Description BCEL caches attacker-controlled classes under their self-declared names without validating the requested name. This allows subsequent lookups and name-keyed verification results to refer...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

Apache Commons JCS 3.2.1 Unauthenticated Deserialization

Apache Commons JCS version 3.2.1 contains an unauthenticated Java deserialization vulnerability in its TCP Lateral Cache listener that could allow remote code execution when the lateral cache is enabled. / Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization Vendor: The Apache Software...

text4shell

text4shell A demonstration of CVE-2022-42889 text4shell remote code execution vulnerability. Details in Don't Panic!: CVE-2022-42889 Text4shell vulnerability in Apache Commons Text...

CLSA-2026-1791205000 TuxCare security update for commons-configuration:commons-configuration (1 CVE)

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.3...

Astra Linux – Vulnerability in Commons-BeanUtils

Apache Commons has a vulnerability related to improper access control. A special BeanIntrospector class was added in version 1.9.2. This can be used to prevent attackers from using the declared class property of Java enum objects to gain access to the classloader. However, this protection was not...

CLSA-2026-1791192746 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.1.10.RELEASE-tuxcare.1...

CLSA-2026-1790951905 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.16-tuxcare.2...

CLEANSTART-2026-JU98285 Uncontrolled Recursion vulnerability in Apache Commons

Security vulnerability affects the apache-nifi package. Uncontrolled Recursion vulnerability in Apache Commons...

CLEANSTART-2026-VJ67556 Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPaylo...

Security vulnerability affects the apache-nifi package. Spring Data Commons contains a vulnerability that can lead to a Denial of Service DoS condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted...

CLEANSTART-2026-PG68728 Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters

Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...

CLEANSTART-2026-MV17823 Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution

Security vulnerability affects the apache-nifi package. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution...

CentOS Linux 7 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (CENTOS7:CLSA-2026:1780929699)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1780929699 advisory. - Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker...

Rocky Linux 10.0 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_14178)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514178 advisory. tomcat: Apache Tomcat DoS in multipart upload CVE-2025-48988 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources CVE-2025-49125...

Rocky Linux 9 [CIQ] Security Update: bcel (crlsa-2023_0005)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20230005 advisory. Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing CVE-2022-42920 Tenable has extracted the preceding description block directly from the CI...