All issues

Search results

[SECURITY] Deserialization RCE via PUT /runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.1)

Status: Open.

#4293 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via CMMN REST task variable interface with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4292 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via TaskVariableCollectionResource multipart endpoint with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4291 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via ProcessInstanceVariableResource.updateVariable (multipart) with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4290 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via POST /runtime/process-instances/{processInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4289 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via PUT /runtime/process-instances/{processInstanceId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4288 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via ExecutionVariableCollectionResource.createExecutionVariable with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4287 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via PUT /runtime/executions/{executionId}/variables (multipart) with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4286 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via PUT /cmmn-runtime/tasks/{taskId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4285 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables/{variableName} with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4284 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

[SECURITY] Deserialization RCE via PUT /cmmn-runtime/case-instances/{caseInstanceId}/variables with type=serializable (CWE-502, CVSS 8.8)

Status: Open.

#4283 In flowable/flowable-engine;

· Jiecub3 opened on Sep 29, 2026

Authorization Bypass Through User-Controlled Key in the External-Worker Job API

Status: Open.

#4282 In flowable/flowable-engine;

· CyanM0un opened on Sep 28, 2026