org.apache.shindig vulnerabilities

Products

• org.apache.shindig/shindig-common 1
• org.apache.shindig/shindig-php 1
• org.apache.shindig/shindig-social-api 1

Latest org.apache.shindig CVEs

Newest publication first

1. CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

   Published 2026-08-13

   High·CVSS 7.2 EPSS 0.94%

   ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As...

2. CVE-2013-4295 Apache Shindig PHP Sensitive Information Disclosure

   Published 2013-10-24

   Medium·CVSS 5.0 EPSS 11.7%

   The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.