Vendor
FasterXML
Tracked since 29 Oct · latest article 29 Oct · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
usual rate
Exploited, by due date
No FasterXML CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds FasterXML CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a FasterXML CVE to KEV.
Fix listed
1 of 2 CVEs in coverage
1 CVE has no vendor fix recorded yet.
EPSS percentile of each CVE
One dot per CVE; a red diamond marks those in CISA KEV.
Show as tableHide table
| CVE | EPSS percentile |
|---|---|
| CVE-2026-110879 | 68 |
| CVE-2026-54512 | 60.9 |
Coverage1 article · all time
The latest article naming FasterXML, in the shared story grammar.
1 article from 1 outlet since 29 Oct. Still developing; the latest report was 1 hour ago.
- Thu 29 Oct, 02:00 UTC. SecurityOnline, first report. FasterXML discloses critical Jackson deserialisation flaw.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 1 articles as a listHide the list
- Thu 29 OctDay 01
- FasterXML discloses critical Jackson deserialisation flaw02:00 · SecurityOnline · First report
All CVEs in coverage2
Exploited first, then by EPSS
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
9.8Critical1.2% EPSS · 1 articlejackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
8.1High0.9% EPSS · 1 article