org.apache.causeway.core vulnerabilities

Products

• org.apache.causeway.core/causeway-applib 1
• org.apache.causeway.core/causeway-core 1

Latest org.apache.causeway.core CVEs

Newest publication first

1. CVE-2025-64408 Apache Causeway: Java deserialization vulnerability to authenticated attackers

   Published 2025-11-19

   Medium·CVSS 6.3 EPSS 11.6%

   Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to ex...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.