dev.savantly.nexus:nexus-command-webapp (3.4.0), org.apache.causeway.mavendeps:causeway-mavendeps-webapp (>=2.0.0-rc1, <=4.0.0-m2) potentially affected by CVE-2025-64408 via org.apache.causeway.viewer:causeway-viewer-wicket-viewer (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.viewer:causeway-viewer-wicket-viewer MAVEN version =2.0.0, =2.0.0-rc1, =4.0.0-m2 Source cves: CVE-2025-64408 Source advisory: SNYK:JAVA-ORGAPACHECAUSEWAYVIEWER-14052594...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:common-types-module (3.4.0) +156 more potentially affected by CVE-2025-64408 via org.apache.causeway.commons:causeway-commons (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.commons:causeway-commons MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.commons:causeway-commons and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +129 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-metamodel (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-metamodel MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-metamodel and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:common-types-module (3.4.0) +152 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-applib (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-applib MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-applib and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +135 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-config (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-config MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-config and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 -...

dev.savantly.nexus:agents-module (3.4.0), dev.savantly.nexus:flow-module (3.4.0) +43 more potentially affected by CVE-2025-64408 via org.apache.causeway.core:causeway-core-runtimeservices (>=2.0.0, <=4.0.0-m2)

org.apache.causeway.core:causeway-core-runtimeservices MAVEN version =2.0.0, =4.0.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.causeway.core:causeway-core-runtimeservices and may be impacted: - dev.savantly.nexus:agents-module 3.4.0 ...

CVE-2025-64408 Apache Causeway: Java deserialization vulnerability to authenticated attackers

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...