CVE-2026-66909

The Apache CXF JMS transport component is vulnerable to unsafe deserialization because it processes the body of inbound JMS ObjectMessages using native Java deserialization without any type restrictions. A remote attacker capable of placing a message on the service's JMS destination can submit a ...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...