UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-123374
Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client deserializes Java object data contained in the ping target's response, so a party that controls that response can run code in the Roller server process. This issue affects Apache Roller from 4.0 through 6.1.6. Users are recommended to upgrade to version 6.1.7, which removes the unsafe deserialization.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cve id
- CVE-2026-123374
- First seen by Signal
- 2026-11-11T15:41:39+00:00
- Name
- CVE-2026-123374
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Published at
- 2026-11-11T13:17:17.340
- Last modified
- 2026-11-11T13:17:17.340
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph