https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T20:31:22.222657+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-86811 CVE-2026-86811 — Apache TomEE: Path traversal via stateful EJB passivation 2026-11-10T20:31:22.223828+00:00

Affected: Apache Software Foundation Apache TomEE

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.