# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-4vjp-327p-w4qv.md)
  `GHSA-4vjp-327p-w4qv`, `CVE-2025-31722` · Maven `org.jenkins-ci.plugins:templating-engine`: affected `<2.5.4`, fixed in `2.5.4` · CVSS 8.8 High · Not analysed yet · Published 2 Apr 2025 · Tags: Code injection
- [Jenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job \`config.xml\` Files](https://agentprime.io/advisories/GHSA-2wxq-944j-5g2v.md)
  `GHSA-2wxq-944j-5g2v`, `CVE-2025-31726` · Maven `org.jenkins-ci.plugins:stackhammer`: affected `<=1.0.6`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Broken access control, Information disclosure
- [jooby-pac4j: deserialization of untrusted data](https://agentprime.io/advisories/GHSA-7c5v-895v-w4q5.md)
  `GHSA-7c5v-895v-w4q5`, `CVE-2025-31129` · Maven `io.jooby:jooby-pac4j`: affected `<2.17.0 || >=3.0.0.M1, <3.7.0`, fixed in `2.17.0`, `3.7.0` · CVSS 8.8 High · Not analysed yet · Published 1 Apr 2025 · Tags: Insecure deserialization
- [Apache Camel Missing Header Out Filter Leads to Potential Bypass/Injection Vulnerability](https://agentprime.io/advisories/GHSA-vq4p-pchp-6g6v.md)
  `GHSA-vq4p-pchp-6g6v`, `CVE-2025-30177` · Maven `org.apache.camel:camel-undertow`: affected `>=4.10.0, <4.10.3 || >=4.8.0, <4.8.6`, fixed in `4.10.3`, `4.8.6` · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2025 · Tags: CWE-164
- [Apache Pinot Vulnerable to Authentication Bypass](https://agentprime.io/advisories/GHSA-6jwp-4wvj-6597.md)
  `GHSA-6jwp-4wvj-6597`, `CVE-2024-56325` · Maven `org.apache.pinot:pinot-broker` and 2 more: affected `>=0.8.0, <1.3.0`, fixed in `1.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.80 · Not analysed yet · Published 1 Apr 2025 · Tags: Authentication bypass
- [Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-2c59-37c4-qrx5.md)
  `GHSA-2c59-37c4-qrx5`, `CVE-2025-30065` · Maven `org.apache.parquet:parquet-avro`: affected `<1.15.1`, fixed in `1.15.1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.44 · Not analysed yet · Published 1 Apr 2025 · Tags: Insecure deserialization
- [Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type](https://agentprime.io/advisories/GHSA-3w85-5p9g-h334.md)
  `GHSA-3w85-5p9g-h334`, `CVE-2025-27427` · Maven `org.apache.activemq:artemis-server`: affected `>=2.0.0, <2.40.0`, fixed in `2.40.0` · CVSS 2.3 Low · Not analysed yet · Published 1 Apr 2025 · Tags: Broken access control
- [Netty QUIC hash collision DoS attack](https://agentprime.io/advisories/GHSA-hqqc-jr88-p6x2.md)
  `GHSA-hqqc-jr88-p6x2`, `CVE-2025-29908` · Maven `io.netty.incubator:netty-incubator-codec-quic`: affected `<0.0.71.Final`, fixed in `0.0.71.Final` · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Denial of service
- [Solon Vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-2m4q-2c6r-hmc3.md)
  `GHSA-2m4q-2c6r-hmc3`, `CVE-2025-2961` · Maven `org.noear:solon-view`: affected `<=3.1.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Path traversal
- [Infinispan Potential Out of Memory Error via REST Compare API Buffer API](https://agentprime.io/advisories/GHSA-2q39-w2hw-2pjm.md)
  `GHSA-2q39-w2hw-2pjm`, `CVE-2024-6875` · Maven `org.infinispan:infinispan-query`: affected `<=15.0.5.Final`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: Denial of service
- [Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store](https://agentprime.io/advisories/GHSA-hp88-hfjw-2hg4.md)
  `GHSA-hp88-hfjw-2hg4` · Maven `org.jboss.hal:hal-console`: affected `<3.7.11.Final`, fixed in `3.7.11.Final` · CVSS 4.6 Medium · Withdrawn · Not analysed yet · Published 28 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Apache Kylin Code Injection via JDBC Configuration Alteration](https://agentprime.io/advisories/GHSA-29m8-wh9p-5wc4.md)
  `GHSA-29m8-wh9p-5wc4`, `CVE-2025-30067` · Maven `org.apache.kylin:kylin`: affected `>=4.0.0, <5.0.2`, fixed in `5.0.2` · CVSS 7.2 High · Not analysed yet · Published 27 Mar 2025 · Tags: Code injection
- [Apache Kylin Server-Side Request Forgery (SSRF) via \`/kylin/api/xxx/diag\` Endpoint](https://agentprime.io/advisories/GHSA-3v67-545x-ffc3.md)
  `GHSA-3v67-545x-ffc3`, `CVE-2024-48944` · Maven `org.apache.kylin:kylin-common-server`: affected `>=5.0.0, <5.0.2`, fixed in `5.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 27 Mar 2025 · Tags: Server-side request forgery (SSRF)
- [WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack](https://agentprime.io/advisories/GHSA-5565-3c98-g6jc.md)
  `GHSA-5565-3c98-g6jc`, `CVE-2024-12369` · Maven `org.wildfly.security:wildfly-elytron` and 1 more: affected `>=1.17.0.Final, <2.2.9.Final || >=2.3.0.Final, <2.6.2.Final`, fixed in `2.2.9.Final`, `2.6.2.Final` · CVSS 4.2 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-345
- [Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache](https://agentprime.io/advisories/GHSA-2935-2wfm-hhpv.md)
  `GHSA-2935-2wfm-hhpv`, `CVE-2025-2559` · Maven `org.keycloak:keycloak-services`: affected `<=26.1.4`, no fixed version yet · CVSS 4.9 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: Denial of service
- [OpenDaylight SFC Insecure Shiro Cookie Configuration](https://agentprime.io/advisories/GHSA-xp75-w7vq-5x6j.md)
  `GHSA-xp75-w7vq-5x6j`, `CVE-2025-29314` · Maven `org.opendaylight.sfc:odl-sfc-openflow-renderer` and 1 more: affected `<=0.10.4`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 24 Mar 2025 · Tags: Weak cryptography or TLS
- [OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request](https://agentprime.io/advisories/GHSA-x65v-g96x-c6gw.md)
  `GHSA-x65v-g96x-c6gw`, `CVE-2025-29315` · Maven `org.opendaylight.sfc:sfc-parent`: affected `<=0.10.4`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2025 · Tags: Broken access control
- [OpenDaylight SFC Denial of Service (DoS)](https://agentprime.io/advisories/GHSA-v3vp-fg2v-g7q4.md)
  `GHSA-v3vp-fg2v-g7q4`, `CVE-2025-29313` · Maven `org.opendaylight.sfc:odl-sfc-openflow-renderer` and 1 more: affected `<=0.10.4`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2025 · Tags: Denial of service
- [Spring Security Vulnerable to Authorization Bypass via Security Annotations](https://agentprime.io/advisories/GHSA-hh3m-g4qj-4835.md)
  `GHSA-hh3m-g4qj-4835`, `CVE-2025-22223` · Maven `org.springframework.security:spring-security-core`: affected `>=6.4.0, <6.4.4`, fixed in `6.4.4` · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2025 · Tags: Authentication bypass
- [Apache Commons VFS Has Relative Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-9q4x-fr4m-jp86.md)
  `GHSA-9q4x-fr4m-jp86`, `CVE-2025-27553` · Maven `org.apache.commons:commons-vfs2`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 7.5 High · Not analysed yet · Published 23 Mar 2025 · Tags: Path traversal
- [Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor](https://agentprime.io/advisories/GHSA-3936-3gx6-49c4.md)
  `GHSA-3936-3gx6-49c4`, `CVE-2025-30474` · Maven `org.apache.commons:commons-vfs2`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 5.0 Medium · Not analysed yet · Published 23 Mar 2025 · Tags: Information disclosure
- [aizuda snail-job Vulnerable to Deserialization via \`nodeExpression\` Argument](https://agentprime.io/advisories/GHSA-4m5h-5v4q-4xgq.md)
  `GHSA-4m5h-5v4q-4xgq`, `CVE-2025-2622` · Maven `com.aizuda:snail-job`: affected `=1.4.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2025 · Tags: Insecure deserialization, CWE-20
- [Apache Oozie Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-fmxw-76xq-cmqq.md)
  `GHSA-fmxw-76xq-cmqq`, `CVE-2025-26796` · Maven `org.apache.oozie:oozie-core`: affected `<=5.2.1`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 22 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and Liferay DXP Reveals Data via Forms](https://agentprime.io/advisories/GHSA-9fcg-wrp8-qhr4.md)
  `GHSA-9fcg-wrp8-qhr4`, `CVE-2025-2565` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2024.Q3.0, <2024.Q3.1 || >=2024.Q2.0, <=2024.Q2.12 || >=2024.Q1.1, <2024.Q1.13 || >=2023.Q4.0, <=2023.Q4.10 || >=2023.Q3.1, <=2023.Q3.10`, fixed in `2024.Q3.1`, `2024.Q1.13` · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Information disclosure
- [Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect](https://agentprime.io/advisories/GHSA-2xcr-p767-f3rv.md)
  `GHSA-2xcr-p767-f3rv`, `CVE-2025-27888` · Maven `org.apache.druid:druid`: affected `<31.0.2 || >=32.0.0, <32.0.1`, fixed in `31.0.2`, `32.0.1` · CVSS 5.8 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Cross-site scripting (XSS), Open redirect, Server-side request forgery (SSRF)
- [H2O Vulnerable to Arbitrary File Overwrite](https://agentprime.io/advisories/GHSA-g48v-3p35-88jr.md)
  `GHSA-g48v-3p35-88jr`, `CVE-2024-8616`, `PYSEC-2026-1441` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.10.4.1, <=3.46.0`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal
- [H2O Vulnerable to Denial of Service (DoS) via \`HEAD\` Request](https://agentprime.io/advisories/GHSA-5c8j-g96x-cj78.md)
  `GHSA-5c8j-g96x-cj78`, `CVE-2024-8062`, `PYSEC-2026-1438` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.2.0.1, <=3.46.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-1088
- [H2O Vulnerable to Denial of Service (DoS) via \`/3/ImportFiles\` Endpoint](https://agentprime.io/advisories/GHSA-p2vc-m5fv-9w9m.md)
  `GHSA-p2vc-m5fv-9w9m`, `CVE-2024-7768`, `PYSEC-2026-1443` · Maven `ai.h2o:h2o-core` and 1 more: affected `<=3.46.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Denial of service
- [H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing](https://agentprime.io/advisories/GHSA-6w62-3jvj-mfj6.md)
  `GHSA-6w62-3jvj-mfj6`, `CVE-2024-7765`, `PYSEC-2026-1439` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.32.1.2, <=3.46.0.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-409
- [H2O Vulnerable to Execution of Arbitrary Files](https://agentprime.io/advisories/GHSA-m37h-8r48-2cxj.md)
  `GHSA-m37h-8r48-2cxj`, `CVE-2024-6863`, `PYSEC-2026-1442` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.32.1.2, <=3.46.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-749
- [H2O Vulnerable to Arbitrary File Overwrite via File Export](https://agentprime.io/advisories/GHSA-47f6-5p7h-5f3h.md)
  `GHSA-47f6-5p7h-5f3h`, `CVE-2024-6854`, `PYSEC-2026-1436` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.32.1.1, <=3.46.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal
- [H2O Vulnerable to Denial of Service (DoS) via \`/3/Parse\` Endpoint](https://agentprime.io/advisories/GHSA-wwr9-4gmr-xvq9.md)
  `GHSA-wwr9-4gmr-xvq9`, `CVE-2024-10549`, `PYSEC-2026-1445` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.30.0.7, <=3.46.0.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Denial of service
- [H2O Vulnerable to Denial of Service (DoS) and File Write](https://agentprime.io/advisories/GHSA-wjpv-64v2-2qpq.md)
  `GHSA-wjpv-64v2-2qpq`, `CVE-2024-10572`, `PYSEC-2026-1444` · Maven `ai.h2o:h2o-ext-xgboost` and 1 more: affected `>=3.34.0.1, <=3.46.0.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Code injection, Denial of service
- [H2O Deserialization of Untrusted Data Vulnerability](https://agentprime.io/advisories/GHSA-h7xg-cmpp-48hf.md)
  `GHSA-h7xg-cmpp-48hf`, `CVE-2024-10553`, `PYSEC-2026-351` · Maven `ai.h2o:h2o-core` and 1 more: affected `<3.46.0.6`, fixed in `3.46.0.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Insecure deserialization
- [H2O Vulnerable to Denial of Service (DoS) via \`/3/ParseSetup\` Endpoint](https://agentprime.io/advisories/GHSA-7qq7-pvm9-x8rf.md)
  `GHSA-7qq7-pvm9-x8rf`, `CVE-2024-10550`, `PYSEC-2026-1440` · Maven `ai.h2o:h2o-core` and 1 more: affected `>=3.30.0.7, <=3.46.0.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Denial of service
- [Apache Seata Vulnerable to Data Amplification](https://agentprime.io/advisories/GHSA-65vg-64g8-mwjr.md)
  `GHSA-65vg-64g8-mwjr`, `CVE-2024-54016` · Maven `org.apache.seata:seata-parent`: affected `>=2.0.0, <2.3.0`, fixed in `2.3.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-409
- [Apache Seata Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-2r4x-667f-mpfh.md)
  `GHSA-2r4x-667f-mpfh`, `CVE-2024-47552` · Maven `org.apache.seata:seata-config-core`: affected `>=2.0.0, <2.2.0`, fixed in `2.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Insecure deserialization
- [Spring Security Does Not Enforce Password Length](https://agentprime.io/advisories/GHSA-mg83-c7gq-rv5c.md)
  `GHSA-mg83-c7gq-rv5c`, `CVE-2025-22228` · Maven `org.springframework.security:spring-security-crypto`: affected `>=6.3.0, <6.3.8 || >=6.4.0, <6.4.4 || >=6.2.0, <6.2.10 || >=6.1.0, <6.1.14 || >=6.0.0, <6.0.16 || >=5.8.0, <5.8.18 || <5.7.16`, fixed in `6.3.8`, `6.4.4`, `6.2.10`, `6.1.14`, `6.0.16`, `5.8.18`, `5.7.16` · CVSS 7.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: Authentication bypass, Hard-coded credentials
- [Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-hrc4-p2h3-pjqw.md)
  `GHSA-hrc4-p2h3-pjqw`, `CVE-2025-2536` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2024.Q2.0, <=2024.Q2.11 || >=2024.Q1.1, <2024.Q1.13 || >=2023.Q4.0, <2024.Q4.0 || >=2023.Q3.1, <2024.Q4.0 || >=2024.Q3.0, <2024.Q3.1`, fixed in `2024.Q1.13`, `2024.Q4.0`, `2024.Q3.1` · CVSS 5.1 Medium · Not analysed yet · Published 19 Mar 2025 · Tags: Cross-site scripting (XSS)
- [The WikiManager REST API allows any user to create wikis](https://agentprime.io/advisories/GHSA-gfp2-6qhm-7x43.md)
  `GHSA-gfp2-6qhm-7x43`, `CVE-2025-29926` · Maven `org.xwiki.platform:xwiki-platform-wiki-rest-default`: affected `>=5.4-rc-1, <15.10.15 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0`, fixed in `15.10.15`, `16.4.6`, `16.10.0` · CVSS 7.9 High · Not analysed yet · Published 19 Mar 2025 · Tags: Broken access control
- [XWiki allows unregistered users to access private pages information through REST endpoint](https://agentprime.io/advisories/GHSA-22q5-9phm-744v.md)
  `GHSA-22q5-9phm-744v`, `CVE-2025-29925` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=1.9M1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1`, fixed in `15.10.14`, `16.4.6`, `16.10.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-402
- [XWiki uses the wrong wiki reference in AuthorizationManager](https://agentprime.io/advisories/GHSA-gq32-758c-3wm3.md)
  `GHSA-gq32-758c-3wm3`, `CVE-2025-29924` · Maven `org.xwiki.platform:xwiki-platform-security-authorization-api`: affected `>=6.1-rc-1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1`, fixed in `15.10.14`, `16.4.6`, `16.10.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2025 · Tags: Privilege escalation, Broken access control
- [Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability](https://agentprime.io/advisories/GHSA-xxrg-mg63-qfpj.md)
  `GHSA-xxrg-mg63-qfpj`, `CVE-2025-30196` · Maven `org.jenkins-ci.plugins:anchorchain`: affected `=1.0`, no fixed version yet · CVSS 8.0 High · Not analysed yet · Published 19 Mar 2025 · Tags: Cross-site scripting (XSS)
- [Jenkins Zoho QEngine Plugin Displays Unmasked API Keys](https://agentprime.io/advisories/GHSA-2x3g-rr4w-4qrp.md)
  `GHSA-2x3g-rr4w-4qrp`, `CVE-2025-30197` · Maven `io.jenkins.plugins:zohoqengine`: affected `<1.0.31.v4a_b_1db_6d6a_f2`, fixed in `1.0.31.v4a_b_1db_6d6a_f2` · CVSS 3.1 Low · Not analysed yet · Published 19 Mar 2025 · Tags: Hard-coded credentials, CWE-549
- [Wire has Uncontrolled Recursion on Nested Groups](https://agentprime.io/advisories/GHSA-pwf9-q62p-v7wc.md)
  `GHSA-pwf9-q62p-v7wc`, `CVE-2024-58103` · Maven `com.squareup.wire:wire-runtime`: affected `<5.2.0`, fixed in `5.2.0` · CVSS 5.8 Medium · Not analysed yet · Published 16 Mar 2025 · Tags: Denial of service
- [Snowflake JDBC Driver client-side encryption key in DEBUG logs](https://agentprime.io/advisories/GHSA-q298-375f-5q63.md)
  `GHSA-q298-375f-5q63`, `CVE-2025-27496` · Maven `net.snowflake:snowflake-jdbc`: affected `>=3.0.13, <3.23.1`, fixed in `3.23.1` · CVSS 3.3 Low · Not analysed yet · Published 13 Mar 2025 · Tags: Information disclosure
- [Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check](https://agentprime.io/advisories/GHSA-p53j-g8pw-4w5f.md)
  `GHSA-p53j-g8pw-4w5f`, `CVE-2020-36843` · Maven `net.i2p.crypto:eddsa` and 1 more: affected `<=0.3.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Weak cryptography or TLS
- [Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record](https://agentprime.io/advisories/GHSA-35gq-cvrm-xf94.md)
  `GHSA-35gq-cvrm-xf94`, `CVE-2025-27017` · Maven `org.apache.nifi:nifi-mongodb-services`: affected `>=1.13.0, <2.3.0`, fixed in `2.3.0` · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: Information disclosure
- [Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin](https://agentprime.io/advisories/GHSA-2cv6-4f2r-jq2c.md)
  `GHSA-2cv6-4f2r-jq2c`, `CVE-2025-27867` · Maven `org.apache.felix:org.apache.felix.http.webconsoleplugin`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 5.6 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: Cross-site scripting (XSS)
- [SmallRye Fault Tolerance out-of-memory (OOM) issue](https://agentprime.io/advisories/GHSA-gfh6-3pqw-x2j4.md)
  `GHSA-gfh6-3pqw-x2j4`, `CVE-2025-2240` · Maven `io.smallrye:smallrye-fault-tolerance-core`: affected `>=6.3.0, <6.4.2 || >=6.5.0, <6.9.0`, fixed in `6.4.2`, `6.9.0` · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-1325
- [Apache Camel Message Header Injection through request parameters](https://agentprime.io/advisories/GHSA-96v5-c2h5-56hm.md)
  `GHSA-96v5-c2h5-56hm`, `CVE-2025-29891` · Maven `org.apache.camel:camel-support`: affected `>=3.10.0, <3.22.4 || >=4.9.0, <4.10.2 || >=4.0.0-M1, <4.8.5`, fixed in `3.22.4`, `4.10.2`, `4.8.5` · CVSS 4.2 Medium · EPSS 0.76 · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-164
- [Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims](https://agentprime.io/advisories/GHSA-gvgg-2r3r-53x7.md)
  `GHSA-gvgg-2r3r-53x7`, `CVE-2025-1391` · Maven `org.keycloak:keycloak-services`: affected `>=26.1.0, <26.1.3 || <26.0.10`, fixed in `26.1.3`, `26.0.10` · CVSS 5.4 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: Broken access control
- [Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak](https://agentprime.io/advisories/GHSA-2p82-5wwr-43cw.md)
  `GHSA-2p82-5wwr-43cw`, `CVE-2025-0604` · Maven `org.keycloak:keycloak-ldap-federation`: affected `>=26.1.0, <26.1.3 || <26.0.10`, fixed in `26.1.3`, `26.0.10` · CVSS 5.4 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: Authentication bypass
- [Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT](https://agentprime.io/advisories/GHSA-83qj-6fr2-vhqg.md)
  `GHSA-83qj-6fr2-vhqg`, `BIT-tomcat-2025-24813`, `CVE-2025-24813` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.3 || >=10.1.0-M1, <10.1.35 || >=9.0.0.M1, <9.0.99 || >=8.5.0, <=8.5.100`, fixed in `11.0.3`, `10.1.35`, `9.0.99` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 10 Mar 2025 · Tags: Insecure deserialization, CWE-44
- [LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-47qw-ccjm-9c2c.md)
  `GHSA-47qw-ccjm-9c2c` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API](https://agentprime.io/advisories/GHSA-v232-254c-m6p7.md)
  `GHSA-v232-254c-m6p7` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-2466-4485-4pxj.md)
  `GHSA-2466-4485-4pxj` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-g6wm-2v64-wq36.md)
  `GHSA-g6wm-2v64-wq36`, `CVE-2025-27136` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 5.5 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [Apache Camel: Camel Message Header Injection via Improper Filtering](https://agentprime.io/advisories/GHSA-2c2h-2855-mf97.md)
  `GHSA-2c2h-2855-mf97`, `CVE-2025-27636` · Maven `org.apache.camel:camel-support`: affected `>=3.10.0, <3.22.4 || >=4.0.0-M1, <4.8.5 || >=4.9.0, <4.10.2`, fixed in `3.22.4`, `4.8.5`, `4.10.2` · CVSS 5.6 Medium · EPSS 0.97 · Not analysed yet · Published 9 Mar 2025 · Tags: CWE-178
- [com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public](https://agentprime.io/advisories/GHSA-3w9f-2pph-j5vc.md)
  `GHSA-3w9f-2pph-j5vc`, `CVE-2025-27604` · Maven `com.xwiki.confluencepro:application-confluence-migrator-pro-ui`: affected `<1.11.7`, fixed in `1.11.7` · CVSS 7.5 High · Not analysed yet · Published 7 Mar 2025 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTAzLTA3VDE2OjE5OjI1LjAwMDAwMFoiLCJHSFNBLTN3OWYtMnBwaC1qNXZjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA0LTAyVDE1OjMxOjM4LjAwMDAwMFoiLCJHSFNBLTU2NXItcGY1cS00NXY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA0LTAyVDE1OjMxOjM4LjAwMDAwMFoiLCJHSFNBLTU2NXItcGY1cS00NXY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.