Apache Shindig Social Api
Monthly
Remote code execution in Apache Shindig (all versions) is reachable via the project's REST API, where deserialization of attacker-controlled input allows server-side arbitrary code execution. The vulnerability requires high-privilege API access (CVSS PR:H), limiting opportunistic exploitation, but every deployed instance is permanently exposed because the Apache Software Foundation has retired the project and will not release a fix. No public exploit or KEV listing has been identified at time of analysis, but the combination of RCE impact and no-patch status makes any continued deployment a long-term liability.
Remote code execution in Apache Shindig (all versions) is reachable via the project's REST API, where deserialization of attacker-controlled input allows server-side arbitrary code execution. The vulnerability requires high-privilege API access (CVSS PR:H), limiting opportunistic exploitation, but every deployed instance is permanently exposed because the Apache Software Foundation has retired the project and will not release a fix. No public exploit or KEV listing has been identified at time of analysis, but the combination of RCE impact and no-patch status makes any continued deployment a long-term liability.