Skip to content
OpenAdvisories

Vendor

Alibaba

5 known vulnerabilities.

Products

Fastjson 2 nacos 2 Alibaba Cloud RDS OpenAPI MCP Server 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-16723 Public exploit

    Remote Code Execution in fastjson 1.2.68–1.2.83

    A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

    Alibaba Fastjson com.alibaba:fastjson Maven
  • Critical 10.0
    CVE-2025-70974

    FASTJSON Includes Functionality from Untrusted Control Sphere

    Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there m…

    Alibaba Fastjson com.alibaba:fastjson Maven