CVE-2026-58163
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Jul 29, 2026 · Last modified: Jul 29, 2026 · CWE-502
Not enough EPSS history yet.
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-65883——
——0Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.3hCVE-2026-149748.1 HIG—
——0IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.17hCVE-2026-145129.8 CRI—
——0IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.17hCVE-2026-667139.8 CRI—
——0Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
(only when Tribes clustering is enabled, which is off by default) allows an
unauthenticated remote attacker with network access to the clustering port to
execute arbitrary code via a crafted serialized Java object delivered to the cluster
channel and deserialized in
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are
recommended to upgrade to version 2.0.1, which fixes this issue by removing the
clustering feature entirely.9hCVE-2026-1175610.0 CRI36.9%
——11A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.1dCVE-2026-656178.8 HIG22.8%
——7A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.2d