Lucene search
+L

65930 matches found

NVD
NVD
added 2026/04/27 9:16 a.m.18 views

CVE-2026-40860

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

9.8CVSS0.01226EPSS
SaveExploits2References7
NVD
NVD
added 2026/04/27 9:16 a.m.12 views

CVE-2026-40473

The camel-mina component's MinaConverter.toObjectInputIoBuffer type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or UDP consumer and requests conversion to ObjectInput f...

8.8CVSS0.00872EPSS
SaveExploits2References5
NVD
NVD
added 2026/04/27 9:16 a.m.30 views

CVE-2026-40453

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

9.9CVSS0.01556EPSS
SaveExploits1References6
NVD
NVD
added 2026/04/27 9:16 a.m.17 views

CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS0.0064EPSS
SaveExploits0References2
OSV
OSV
added 2026/04/27 9:16 a.m.38 views

DEBIAN-CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS5.7AI score0.0064EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/04/27 9:16 a.m.12 views

CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS6.1AI score0.0064EPSS
SaveExploits0References2
OSV
OSV
added 2026/04/27 9:16 a.m.14 views

UBUNTU-CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS6AI score0.0064EPSS
SaveExploits0References3
Circl
Circl
added 2026/04/27 9:09 a.m.19 views

CVE-2026-41635

creationtimestamp| type| source ---|---|--- 2026-04-27 09:09:56+00:00| seen| https://ccb.belgium.be/advisories/warning-critical-arbitrary-code-execution-vulnerability-apache-mina-patch-immediately 2026-05-01 01:27:07+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mkqxxdbwbc2e...

9.8CVSS6.5AI score0.0064EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/04/27 8:59 a.m.41 views

CVE-2026-41635 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS0.0064EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/04/27 8:59 a.m.8 views

CVE-2026-41635 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS5.5AI score0.0064EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/04/27 8:59 a.m.10 views

CVE-2026-41635

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class filter...

9.8CVSS5.6AI score0.0064EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/04/27 8:59 a.m.10 views

EUVD-2026-25796

Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them for static classes or primitive types does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class is present in the accepted class...

9.8CVSS5.6AI score0.0064EPSS
SaveExploits0References1
CVE
CVE
added 2026/04/27 8:59 a.m.77 views

CVE-2026-41635

Summary: CVE-2026-41635 affects Apache MINA’s AbstractIoBuffer.resolveClass(), where one code path for static/primitive types neglects the class check and bypasses the classname allowlist, enabling arbitrary code execution through object deserialization. Impact and scope: Affects MINA versions 2....

9.8CVSS5.6AI score0.0064EPSS
SaveExploits0References2Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/04/27 8:16 a.m.10 views

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by Cross-site scripting (XSS) vulnerability due to Apache Solr

Summary Admin UI in Apache Solr is used by IBM Operations Analytics - Log Analysis as part of the Solr administrative web interface. CVE-2015-8797. Vulnerability Details CVEID:CVE-2015-8797 DESCRIPTION: Cross-site scripting XSS vulnerability in webapp/web/js/scripts/plugins.js in the stats page i...

6.1CVSS6.2AI score0.03313EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/04/27 8:03 a.m.16 views

EUVD-2026-25794

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

9.8CVSS6.4AI score0.01226EPSS
SaveExploits2References1
CVE
CVE
added 2026/04/27 8:03 a.m.101 views

CVE-2026-40860

Apache Camel CVE-2026-40860 describes unsafe deserialization of JMS ObjectMessage payloads in camel-jms, camel-sjms, camel-sjms2 and camel-amqp. The root cause is deserialization via javax.jms.ObjectMessage.getObject() without ObjectInputFilter or allow/deny lists, triggered when mapJmsMessage is...

9.8CVSS6.4AI score0.01226EPSS
SaveExploits2References7Affected Software1
EUVD
EUVD
added 2026/04/27 7:53 a.m.21 views

EUVD-2026-25790

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

7.8CVSS6.3AI score0.00246EPSS
SaveExploits1References1
CVE
CVE
added 2026/04/27 7:53 a.m.61 views

CVE-2026-40048

CVE-2026-40048 – Apache Camel PQC deserialization flaw : The Camel-PQC FileBasedKeyLifecycleManager deserializes the contents of .key files in the configured key directory via java.io.ObjectInputStream without ObjectInputFilter or class-loading restrictions. The vulnerable step is that the cast t...

7.8CVSS6.3AI score0.00246EPSS
SaveExploits1References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/04/27 7:53 a.m.11 views

CVE-2026-40048

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of .key files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to java.security.KeyPair is evaluated only after readObject has...

6.3AI score0.00246EPSS
SaveExploits1References2Affected Software1
CNNVD
CNNVD
added 2026/04/27 12:00 a.m.29 views

Apache MINA 代码问题漏洞

Apache MINA is a web application framework developed by the Apache Foundation in the United States. This product is primarily used for developing high-performance and highly scalable web applications. There were code vulnerabilities in versions 2.0.0 to 2.0.27, 2.1.0 to 2.1.10, and 2.2.0 to 2.2.5...

9.8CVSS6.7AI score0.00433EPSS
SaveExploits0References1
Rows per page
Query Builder