CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-43910 Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-43910

CVE-2026-43910 affects the Appium Java Client (8.2.1–10.1.1). When directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() rebuilds the client’s server URL from directConnectHost, directConnectPort, and directConnectPath in the server’s NEW_SESSION response, validating only HTTPS...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: OSV:GHSA-4R9R-4425-74P7...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: SNYK:JAVA-COMCEDARPOLICY-18601848...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: GHSA-4R9R-4425-74P7...

java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Summary When directConnecttrue is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEWSESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Apache Axis2/Java (versions through 2.0.0 ) is vulnerable to a Deserialization of Untrusted Data (CWE-502) flaw within the Tribes-based clustering component when running on Apache Tomcat . If Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering po...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

EUVD-2026-49849

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

ROOT-APP-MAVEN-CVE-2022-31159 CVE-2022-31159 in io.root.com.amazonaws:aws-java-sdk-s3 - Patched by Root

Root has patched CVE-2022-31159 in the io.root.com.amazonaws:aws-java-sdk-s3 package for Root:Maven. Multiple fixed versions available...

Java FTP Proxy Service - Detect

Java FTP Proxy service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Java FTP Proxy service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Java FTP Proxy...

Graphql Java Detect

Detects Graphql Java Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Java Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Java Detect', 'description': 'Detects Graphql Java...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

CData API Server < 23.4.8844 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. !/usr/bin/env python3 -- coding: utf-8 -- """A path...