https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T03:51:29.351317+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-66713 CVE-2026-66713 — Apache Axis2/Java: deserialization of untrusted Data 2026-10-04T03:51:29.354537+00:00

Affected: Apache Software Foundation Apache Axis2/Java

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component

in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat

(only when Tribes clustering is enabled, which is off by default) allows an

unauthenticated remote attacker with network access to the clustering port to

execute arbitrary code via a crafted serialized Java object delivered to the cluster

channel and deserialized in

org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are

recommended to upgrade to version 2.0.1, which fixes this issue by removing the

clustering feature entirely.