dev.fpinbo:jms4s-active-mq-artemis_2.12 (>=0.0.1, <=0.4.0), dev.fpinbo:jms4s-active-mq-artemis_2.13 (>=0.0.1, <=0.4.0) +66 more potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-jms-client-all (>=2.11.0, <=2.31.2)

org.apache.activemq:artemis-jms-client-all MAVEN version =2.11.0, =0.0.1, =0.0.1, =0.0.0-notforuse-03, =0.0.0-notforuse-06, =2.11.0, =2.17.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.31.1 and more Source cves: CVE-2026-101292 Source advisory:...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-jms-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-jms-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

CVE-2026-10751 IBM MQ Java messaging is vulnerable to remote code execution

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...

PT-2026-95465

Name of the Vulnerable Software and Affected Versions IBM MQ Java and JMS client libraries affected versions not specified Description An authenticated attacker can execute arbitrary code on client applications. This is possible due to a deserialization filter bypass occurring during exception...

CVE-2026-10751: Deserialization of Untrusted Data

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-13293)

Summary IBM MQ has addressed a bypass of the Java deserialization allowlist in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code on a system consuming JMS ObjectMessages Vulnerability Details CVEID:CVE-2026-13293 DESCRIPTION: IBM MQ could allow a...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-10751)

Summary IBM MQ has addressed a Java deserialization filter bypass in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10751 DESCRIPTION: IBM MQ Java and JMS client libraries could allow an authenticated attacker ...

EUVD-2021-2590

Malware in sbrugna...

CVE-2020-36282

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data...

ch.inftec.ju:ju-util-ee (>=4.1, <=4.2), com.github.marschall:osgi-remoting-ejb-jboss (0.2.0) +7 more potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.16.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.16.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-util-ee =4.1, =3.0.39, =3.0.39, =3.0.53, =3.0.53, =7.1.83 Source cves: CVE-2021-2025...

org.jboss.as:jboss-as-ejb-client-bom (7.1.0.final), org.jboss.as:jboss-as-jms-client-bom (7.1.0.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.2.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.0.final - org.jboss.as:jboss-as-jms-client-bom 7.1.0.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.3.final), org.jboss.as:jboss-as-jms-client-bom (7.1.3.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.11.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.3.final - org.jboss.as:jboss-as-jms-client-bom 7.1.3.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.2.final), org.jboss.as:jboss-as-jms-client-bom (7.1.2.final) potentially affected by CVE-2021-20250 via org.jboss:jboss-ejb-client (1.0.10.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.2.final - org.jboss.as:jboss-as-jms-client-bom 7.1.2.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.3.final), org.jboss.as:jboss-as-jms-client-bom (7.1.3.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.11.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.3.final - org.jboss.as:jboss-as-jms-client-bom 7.1.3.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.2.final), org.jboss.as:jboss-as-jms-client-bom (7.1.2.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.10.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.2.final - org.jboss.as:jboss-as-jms-client-bom 7.1.2.final...

org.wildfly:wildfly-ee (8.0.0.alpha1), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha1) +8 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.21.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.21.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha1 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha1 -...

org.wildfly:wildfly-ee (8.0.0.alpha2), org.wildfly:wildfly-ejb-client-bom (8.0.0.alpha2) +8 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.22.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.22.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-ee 8.0.0.alpha2 - org.wildfly:wildfly-ejb-client-bom 8.0.0.alpha2 -...

org.wildfly:wildfly-client-all (9.0.0.alpha1), org.wildfly:wildfly-clustering-ejb-spi (>=8.1.0.cr1, <=9.0.0.alpha1) +2 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (2.0.1.final)

org.jboss:jboss-ejb-client MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.wildfly:wildfly-client-all 9.0.0.alpha1 - org.wildfly:wildfly-clustering-ejb-spi =8.1.0.cr1,...