Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

ai.h2o:h2o-algos (=0.1.9), ai.h2o:h2o-app (=0.1.9) +2025 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-kqueue (>=4.1.11.Final <=4.1.134.Final)

io.netty:netty-transport-native-kqueue MAVEN version =4.1.11.Final, =3.30.1.1, =3.10.0.5, =0.2.3.5, =2.4.0, =1.5.0, =3.0.0, =3.0.0, =1.0.3, =4.4.0, =4.7.3 and more Source cves: CVE-2026-45536 Source advisory: OSV:GHSA-W573-9FFJ-6FF9...

hermes-sidecar-poc

Hermes PoC — Pod + Nacos + Math microservice Dubbo Triple S...

Exploit for CVE-2026-22679

CVE-2026-22679: Weaver E-cology Unauthenticated RCE via dubboA...

CVE-2026-22679 Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...

Malicious code in dubbo-web-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89acd0553894e9764e6be95bd53e03f5ecab30099098b94c5f7e74e44af8695 The package dubbo-web-example was found to contain malicious code...

MAL-2026-1720 Malicious code in dubbo-web-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89acd0553894e9764e6be95bd53e03f5ecab30099098b94c5f7e74e44af8695 The package dubbo-web-example was found to contain malicious code...

EUVD-2025-203513

Malicious code in dubbo-js-private-workspace npm...

Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview dubbo-js-private-workspace is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-192586 Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...

Remote Code Execution (RCE)

org.apache.dubbo:dubbo is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization handling in hessian-lite during exception logging, which allows an attacker to execute malicious code through crafted serialized data...

EUVD-2021-2105

Malware in sbrugna...

EUVD-2021-2100

Malware in sbrugna...

EUVD-2021-2103

Malware in sbrugna...

EUVD-2021-2042

Malware in sbrugna...

EUVD-2022-1431

Malicious code in bioql PyPI...

EUVD-2022-7031

Malicious code in bioql PyPI...

EUVD-2022-1367

Malicious code in bioql PyPI...

EUVD-2022-1324

Malicious code in bioql PyPI...