Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but disti

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Ty

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-IN

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected vers

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" paramete

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WA

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for th

Tapestry processes assets /assets/ctx using classes chain StaticFilesFilter - AssetDispatcher - ContextResource, which doesn't

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded.

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which