CVE-2026-40858

camel-infinispan Remote Aggregation Repository Unsafe Deserialization Reproducer CVE-2026-40858 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-infinispan component, tracked as CVE-2026-40858. The ProtoStream-based remote aggregation repository serializes ea...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: apache-tika, cass-config-builder, wildfly, keycloak, apache-nifi, logstash, dependency-track, scala, apache-nifi-registry, gradle, apicurio-registry, trino, spark, opensearch, infinispan, sonarqube, tez, flyway, akhq, spdx-tools-java, strimzi-kafka-operator,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: apache-tika, cass-config-builder, wildfly, keycloak, apache-nifi, logstash, dependency-track, scala, apache-nifi-registry, gradle, apicurio-registry, trino, spark, opensearch, infinispan, sonarqube, tez, flyway, akhq, spdx-tools-java, strimzi-kafka-operator,...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

io.quarkus:quarkus-elytron-security-oauth2 (>=3.32.0.cr1, <=3.35.4), io.quarkus:quarkus-elytron-security-oauth2-deployment (>=3.32.0.cr1, <=3.35.4) +19 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron-realm-token (>=2.8.0.final, <=2.8.5.final)

org.wildfly.security:wildfly-elytron-realm-token MAVEN version =2.8.0.final, =3.32.0.cr1, =3.32.0.cr1, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =16.2.0.dev01, =26.6.0, =26.6.0, =26.6.0, =31.0.2.final, =31.0.2.final, =31.0.2.final, =31.0.2.final, =4.2.0.cr1, =4.2.1.final and mor...

io.quarkus:quarkus-elytron-security-oauth2 (>=3.38.0.cr1, <=4.0.0.beta1), io.quarkus:quarkus-elytron-security-oauth2-deployment (>=3.38.0.cr1, <=4.0.0.beta1) +19 more potentially affected by CVE-2026-85511 via org.wildfly.security:wildfly-elytron-realm-token (>=2.9.2.final, <=2.9.2.sp1)

org.wildfly.security:wildfly-elytron-realm-token MAVEN version =2.9.2.final, =3.38.0.cr1, =3.38.0.cr1, =16.2.2, =16.2.2, =16.2.2, =16.2.2, =16.2.2, =26.8.0, =26.8.0, =26.8.0, =33.0.0.beta4, =33.0.0.beta4, =33.0.0.beta4, =33.0.0.beta4, =2.9.2.final, =2.9.2.sp1 and more Source cves: CVE-2026-85511...

Infinispan Command Line Disclosure Sensitive Information

The vulnerability of the command-line interface of data storage software called Infinispan is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-093039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093039 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-032351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032351 advisory. A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-093035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093035 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: rancher-telemetry, opentelemetry-collector-contrib, etcd, aws-node-termination-handler, guac, infinispan-operator, amazon-cloudwatch-agent, kubernetes, emissary, verticadb-operator, redis-operator, jitsucom-bulker, kubevela, op-geth, juicefs-csi-driver, cloudflared...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: wildfly, keycloak, thingsboard, celeborn, apache-pulsar, logstash, zipkin, apicurio-registry, trino, spark, apache-activemq-artemis, druid, opensearch, neo4j, infinispan, tez, sonarqube, kserve-modelmesh, management-api-for-apache-cassandra-5.0, wavefront-proxy,...

GHSA-8C42-7QJ2-3J46 vulnerabilities

Vulnerabilities for packages: wildfly, keycloak, thingsboard, celeborn, apache-pulsar, logstash, zipkin, apicurio-registry, trino, spark, apache-activemq-artemis, druid, opensearch, neo4j, infinispan, tez, sonarqube, kserve-modelmesh, management-api-for-apache-cassandra-5.0, wavefront-proxy,...

CVE-2026-49844 vulnerabilities

Vulnerabilities for packages: apache-tika, wildfly, flink, thingsboard, celeborn, apache-pulsar, solr, zipkin, trino, spark, apache-activemq-artemis, druid, opensearch, neo4j, infinispan, sonarqube, kserve-modelmesh, kafka, wavefront-proxy, akhq, spdx-tools-java, strimzi-kafka-operator,...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: apache-tika, wildfly, flink, thingsboard, celeborn, apache-pulsar, solr, zipkin, trino, spark, apache-activemq-artemis, druid, opensearch, neo4j, infinispan, sonarqube, kserve-modelmesh, kafka, wavefront-proxy, akhq, spdx-tools-java, strimzi-kafka-operator,...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...