https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:45:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66713 <p><strong>Affected:</strong> Apache Software Foundation Apache Axis2/Java</p> <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Axis2/Java</p> <p>Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component</p> <p>in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat</p> <p>(only when Tribes clustering is enabled, which is off by default) allows an</p> <p>unauthenticated remote attacker with network access to the clustering port to</p> <p>execute arbitrary code via a crafted serialized Java object delivered to the cluster</p> <p>channel and deserialized in</p> <p>org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are</p> <p>recommended to upgrade to version 2.0.1, which fixes this issue by removing the</p> <p>clustering feature entirely.</p> https://vulnerability.circl.lu/vuln/cve-2026-66713