Posted by Robert Lazarski on Nov 06 Severity: critical Affected versions: - Apache Axis 1.x (EOL) through 1.4 - Apache Axis 1.x (EOL) through 1.4 - Apache Axis 1.x (EOL) aac718c6035435d96b39d6aebb9c078a13af7cc8 before 41f3b4e8d04e310ca81f86b92630ab2c11d608bd Description: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a...
CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/546
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing
Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and…
CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
Posted by Robert Rothenberg on Nov 14 CVE-2015-10149 CPAN Security Group CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN…
CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
Posted by Robert Rothenberg on Nov 14 CVE-2011-10042 CPAN Security Group CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN…