Apache Software Foundation Tapestry vulnerabilities

• apache tapestry Apache Tapestry: Possible classpath file download through URL manipulation CVE-2026-61899 7.5 HighAugust 10, 2026
• apache tapestry Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input CVE-2022-46366 Fix available 9.8 CriticalDecember 2, 2022
• apache tapestry Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022) CVE-2022-31781 Fix available 7.5 HighJuly 13, 2022
• apache tapestry An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later CVE-2021-30638 Fix available 7.5 HighApril 27, 2021
• apache tapestry Bypass of the fix for CVE-2019-0195 CVE-2021-27850 Public exploitFix available EPSS 93.6% 9.8 CriticalApril 15, 2021
• apache tapestry Deserialization flaw in EOL Tapestry 4. CVE-2020-17531 Public exploitFix available 9.8 CriticalDecember 8, 2020
• apache tapestry Improper file downloads in Apache Tapestry CVE-2020-13953 Fix available 5.3 MediumSeptember 30, 2020
• apache tapestry Timing attack on HMAC signature comparison in Apache Tapestry CVE-2019-10071 Fix available 9.8 CriticalSeptember 16, 2019
• apache tapestry Path traversal attack on Windows platforms CVE-2019-0207 Public exploitFix available 7.5 HighSeptember 16, 2019
• apache tapestry Deserialization of Untrusted Data in Apache Tapestry CVE-2019-0195 Fix available EPSS 14.0% 9.8 CriticalSeptember 16, 2019