openmeetings-cluster-openjpa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-cluster-openjpa Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-cluster-openjpa Class: CWE-502 Reach: Remote Apache OpenMeetings 9.1.0. Leftover of CVE-2024-54676 doc...

CVE-2026-118636

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

EUVD-2026-114734

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-118636

The Apache MINA codec module (branch 3.0.0) contains an unsafe deserialization vulnerability in JavaNativeMessageDecoder . The component calls ObjectInputStream.readObject() on frame bytes without a class filter, allowing an attacker to execute a gadget-chain RCE when the application interacts wi...

PT-2026-134678

Name of the Vulnerable Software and Affected Versions Apache MINA version 3.0.0 Description The JavaNativeMessageDecoder in the codec module uses ObjectInputStream.readObject on frame bytes without implementing a class filter. This allows an attacker who can send data to an application using this...

CVE-2026-118636: Apache Software Foundation Apache MINA: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

Exploit for Deserialization of Untrusted Data in Cisco Secure_Firewall_Management_Center

CVE-2026-20131 -- unauthenticated Java deserialization, root o...

CVE-2026-102469

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x DB2 client vertx-db2-client contains DRDA protocol handling code that deserializes User Defined Type UDT column data using a bare ObjectInputStream.readObject call with no ObjectInputFilter or clas...

CVE-2026-102469: Deserialization of Untrusted Data

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x DB2 client vertx-db2-client contains DRDA protocol handling code that deserializes User Defined Type UDT column data using a bare ObjectInputStream.readObject call with no ObjectInputFilter or clas...

CVE-2023-54398: Deserialization of Untrusted Data

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

VulnCheck KEV: CVE-2023-54398

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...

CVE-2026-47878

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-43865

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no...

CVE-2026-41586

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...

Unsafe Deserialization

Apache Camel is vulnerable to Unsafe Deserialization. The vulnerability is due to deserialization of untrusted data in FileBasedKeyLifecycleManager using ObjectInputStream.readObject without applying an ObjectInputFilter, where attacker-controlled .key files can trigger execution of malicious cod...

CVE-2026-35337: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject without any class filtering or...

CVE-2025-15222

A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high...