# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [JRuby-OpenSSL has hostname verification disabled by default](https://agentprime.io/advisories/GHSA-72qj-48g4-5xgx.md)
  `GHSA-72qj-48g4-5xgx`, `CVE-2025-46551` · Maven `org.jruby:jruby` and 2 more: affected `>=10.0.0.0, <10.0.0.1 || >=9.3.4.0, <9.4.12.1`, fixed in `10.0.0.1`, `9.4.12.1` · CVSS 5.7 Medium · Not analysed yet · Published 7 May 2025 · Tags: Weak cryptography or TLS
- [Graylog Allows Session Takeover via Insufficient HTML Sanitization](https://agentprime.io/advisories/GHSA-76vf-mpmx-777j.md)
  `GHSA-76vf-mpmx-777j`, `CVE-2025-46827` · Maven `org.graylog2:graylog2-server`: affected `<6.0.14 || >=6.1.0, <6.1.10`, fixed in `6.0.14`, `6.1.10` · CVSS 8.0 High · Not analysed yet · Published 7 May 2025 · Tags: Cross-site scripting (XSS)
- [Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser](https://agentprime.io/advisories/GHSA-q9q2-3ppx-mwqf.md)
  `GHSA-q9q2-3ppx-mwqf` · Maven `org.graylog2:graylog2-server`: affected `<6.2.0`, fixed in `6.2.0` · CVSS 7.3 High · Not analysed yet · Published 7 May 2025 · Tags: Cross-site scripting (XSS)
- [Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation](https://agentprime.io/advisories/GHSA-whxr-3p84-rf3c.md)
  `GHSA-whxr-3p84-rf3c`, `BIT-activemq-2025-27533`, `CVE-2025-27533` · Maven `org.apache.activemq:activemq-client` and 1 more: affected `<5.16.8 || >=5.17.0, <5.17.7 || >=5.18.0, <5.18.7 || >=6.0.0, <6.1.6`, fixed in `5.16.8`, `5.17.7`, `5.18.7`, `6.1.6` · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2025 · Tags: Denial of service
- [HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store](https://agentprime.io/advisories/GHSA-f7jh-m6wp-jm7f.md)
  `GHSA-f7jh-m6wp-jm7f`, `CVE-2025-2901` · Maven `org.jboss.hal:hal-console`: affected `<3.7.11.Final`, fixed in `3.7.11.Final` · CVSS 4.6 Medium · Not analysed yet · Published 6 May 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Reflected XSS in marketplace-app-manager-web](https://agentprime.io/advisories/GHSA-p2f8-vq4r-gqg3.md)
  `GHSA-p2f8-vq4r-gqg3`, `CVE-2025-4388` · Maven `com.liferay:com.liferay.marketplace.app.manager.web`: affected `<5.0.50`, fixed in `5.0.50` · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2025 · Tags: Cross-site scripting (XSS)
- [Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata](https://agentprime.io/advisories/GHSA-53wx-pr6q-m3j5.md)
  `GHSA-53wx-pr6q-m3j5`, `CVE-2025-46762` · Maven `org.apache.parquet:parquet-avro`: affected `<1.15.2`, fixed in `1.15.2` · CVSS 7.1 High · Not analysed yet · Published 6 May 2025 · Tags: Path traversal
- [BRCC Incorrect Access Control vulnerability](https://agentprime.io/advisories/GHSA-w7xj-pj5f-8pwh.md)
  `GHSA-w7xj-pj5f-8pwh`, `CVE-2025-45616` · Maven `com.baidu.mapp:brcc-core`: affected `<=1.2.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2025 · Tags: Broken access control
- [WSO2 API Manager XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-h94w-8qhg-3xmc.md)
  `GHSA-h94w-8qhg-3xmc`, `CVE-2025-2905` · Maven `org.wso2.am:am-distribution-parent`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2025 · Tags: XML external entities (XXE)
- [Elasticsearch Uncontrolled Resource Consumption Vulnerability](https://agentprime.io/advisories/GHSA-mm3m-5497-xggg.md)
  `GHSA-mm3m-5497-xggg`, `BIT-elasticsearch-2024-52979`, `CVE-2024-52979` · Maven `org.elasticsearch:elasticsearch`: affected `<7.17.25 || >=8.0.0-alpha1, <8.16.0`, fixed in `7.17.25`, `8.16.0` · CVSS 6.5 Medium · Not analysed yet · Published 1 May 2025 · Tags: Denial of service
- [Keycloak vulnerable to two factor authentication bypass](https://agentprime.io/advisories/GHSA-5jfq-x6xp-7rw2.md)
  `GHSA-5jfq-x6xp-7rw2`, `BIT-keycloak-2025-3910`, `CVE-2025-3910` · Maven `org.keycloak:keycloak-services`: affected `<26.2.2`, fixed in `26.2.2` · CVSS 5.4 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: Authentication bypass
- [Keycloak hostname verification](https://agentprime.io/advisories/GHSA-hw58-3793-42gg.md)
  `GHSA-hw58-3793-42gg`, `CVE-2025-3501` · Maven `org.keycloak:keycloak-services`: affected `<26.2.2`, fixed in `26.2.2` · CVSS 8.2 High · Not analysed yet · Published 30 Apr 2025 · Tags: Weak cryptography or TLS
- [org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content](https://agentprime.io/advisories/GHSA-8g2j-rhfh-hq3r.md)
  `GHSA-8g2j-rhfh-hq3r`, `CVE-2025-46558` · Maven `org.xwiki.contrib.markdown:syntax-markdown-commonmark12`: affected `>=8.2, <8.9`, fixed in `8.9` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Any user with view access to the XWiki space can change the authenticator](https://agentprime.io/advisories/GHSA-f9c6-2f9p-82jj.md)
  `GHSA-f9c6-2f9p-82jj`, `CVE-2025-46557` · Maven `org.xwiki.platform:xwiki-platform-security-authentication-ui`: affected `>=15.3-rc-1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1`, fixed in `15.10.14`, `16.4.6`, `16.10.0-rc-1` · CVSS 8.4 High · Not analysed yet · Published 30 Apr 2025 · Tags: Broken access control
- [XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API](https://agentprime.io/advisories/GHSA-r5cr-xm48-97xp.md)
  `GHSA-r5cr-xm48-97xp`, `CVE-2025-46554` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=1.8.1, <14.10.22 || >=15.0-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.7.0`, fixed in `14.10.22`, `15.10.12`, `16.4.3`, `16.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: Broken access control
- [Duplicate Advisory: Keycloak hostname verification](https://agentprime.io/advisories/GHSA-r934-w73g-v4p8.md)
  `GHSA-r934-w73g-v4p8` · Maven `org.keycloak:keycloak-services`: affected `<26.2.2`, fixed in `26.2.2` · CVSS 8.2 High · Withdrawn · Not analysed yet · Published 29 Apr 2025 · Tags: Weak cryptography or TLS
- [Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass](https://agentprime.io/advisories/GHSA-fx44-2wx5-5fvp.md)
  `GHSA-fx44-2wx5-5fvp` · Maven `org.keycloak:keycloak-services`: affected `<26.2.2`, fixed in `26.2.2` · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 29 Apr 2025 · Tags: Authentication bypass
- [org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type](https://agentprime.io/advisories/GHSA-mvgm-3rw2-7j4r.md)
  `GHSA-mvgm-3rw2-7j4r`, `CVE-2025-32974` · Maven `org.xwiki.platform:xwiki-platform-security-requiredrights-default`: affected `>=15.9-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.2.0`, fixed in `15.10.8`, `16.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2025 · Tags: Privilege escalation, CWE-116
- [org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right](https://agentprime.io/advisories/GHSA-x7wv-5qg4-vmr6.md)
  `GHSA-x7wv-5qg4-vmr6`, `CVE-2025-32973` · Maven `org.xwiki.platform:xwiki-platform-component-wiki`: affected `>=15.9-rc-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.8.0-rc-1`, fixed in `15.10.12`, `16.4.3`, `16.8.0-rc-1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2025 · Tags: Broken access control
- [The lesscss script service allows cache clearing without programming right](https://agentprime.io/advisories/GHSA-rp38-24m3-rx87.md)
  `GHSA-rp38-24m3-rx87`, `CVE-2025-32972` · Maven `org.xwiki.platform:xwiki-platform-lesscss-script`: affected `>=6.1-milestone-1, <15.10.12 || >=16.0.0-rc-1, <16.4.3 || >=16.5.0-rc-1, <16.8.0-rc-1`, fixed in `15.10.12`, `16.4.3`, `16.8.0-rc-1` · CVSS 2.7 Low · Not analysed yet · Published 29 Apr 2025 · Tags: Broken access control
- [Solr script service doesn't take dropped programming right into account](https://agentprime.io/advisories/GHSA-987p-r3jc-8c8v.md)
  `GHSA-987p-r3jc-8c8v`, `CVE-2025-32971` · Maven `org.xwiki.platform:xwiki-platform-search-solr-api`: affected `>=4.5.1, <15.10.13 || >=16.0.0-rc-1, <16.4.4 || >=16.5.0-rc-1, <16.8.0-rc-1`, fixed in `15.10.13`, `16.4.4`, `16.8.0-rc-1` · CVSS 3.8 Low · Not analysed yet · Published 29 Apr 2025 · Tags: Broken access control
- [org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-pjhg-9wr9-rj96.md)
  `GHSA-pjhg-9wr9-rj96`, `CVE-2025-32970` · Maven `org.xwiki.platform:xwiki-platform-wysiwyg-api`: affected `>=13.5-rc-1, <15.10.13 || >=16.0.0-rc-1, <16.4.4 || >=16.5.0-rc-1, <16.8.0`, fixed in `15.10.13`, `16.4.4`, `16.8.0` · CVSS 6.1 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: Open redirect
- [Apache Tomcat Rewrite rule bypass](https://agentprime.io/advisories/GHSA-ff77-26x5-69cr.md)
  `GHSA-ff77-26x5-69cr`, `BIT-tomcat-2025-31651`, `CVE-2025-31651` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-116, CWE-150
- [Apache Tomcat Denial of Service via invalid HTTP priority header](https://agentprime.io/advisories/GHSA-3p2h-wqq4-wf4h.md)
  `GHSA-3p2h-wqq4-wf4h`, `BIT-tomcat-2025-31650`, `CVE-2025-31650` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.61 · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-459, CWE-460
- [Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed](https://agentprime.io/advisories/GHSA-rc42-6c7j-7h5r.md)
  `GHSA-rc42-6c7j-7h5r`, `CVE-2025-22235` · Maven `org.springframework.boot:spring-boot`: affected `<=2.7.24.2 || >=3.1.0, <=3.1.15.2 || >=3.2.0, <=3.2.13.2 || >=3.3.0, <3.3.11 || >=3.4.0, <3.4.5`, fixed in `3.3.11`, `3.4.5` · CVSS 7.3 High · Not analysed yet · Published 28 Apr 2025 · Tags: Broken access control, CWE-20
- [Apereo CAS has inefficient regular expression complexity](https://agentprime.io/advisories/GHSA-mvwq-hcrj-f5x9.md)
  `GHSA-mvwq-hcrj-f5x9`, `CVE-2025-3986` · Maven `org.apereo.cas:cas-server-core-configuration-metadata-repository`: affected `<=5.2.6`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2025 · Tags: Denial of service
- [Apereo CAS has inefficient regular expression complexity](https://agentprime.io/advisories/GHSA-8rx4-fxq5-vj4v.md)
  `GHSA-8rx4-fxq5-vj4v`, `CVE-2025-3985` · Maven `org.apereo.cas:cas-management-webapp-support`: affected `<=5.2.6`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 27 Apr 2025 · Tags: Denial of service
- [Apereo CAS code injection vulnerability](https://agentprime.io/advisories/GHSA-37pq-893f-g7q5.md)
  `GHSA-37pq-893f-g7q5`, `CVE-2025-3984` · Maven `org.apereo.cas:cas-management-webapp-support`: affected `<=5.2.6`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 27 Apr 2025 · Tags: Other injection, Code injection
- [Apache HttpClient disables domain checks](https://agentprime.io/advisories/GHSA-73m2-qfq3-56cx.md)
  `GHSA-73m2-qfq3-56cx`, `CVE-2025-27820` · Maven `org.apache.httpcomponents.client5:httpclient5`: affected `>=5.4-alpha1, <5.4.3`, fixed in `5.4.3` · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: Weak cryptography or TLS
- [org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API](https://agentprime.io/advisories/GHSA-f69v-xrj8-rhxf.md)
  `GHSA-f69v-xrj8-rhxf`, `CVE-2025-32969` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=1.8, <15.10.16 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.1`, fixed in `15.10.16`, `16.4.6`, `16.10.1` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.80 · Not analysed yet · Published 23 Apr 2025 · Tags: SQL injection
- [org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API](https://agentprime.io/advisories/GHSA-g9jj-75mx-wjcx.md)
  `GHSA-g9jj-75mx-wjcx`, `CVE-2025-32968` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=1.6-milestone-1, <15.10.16 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.1`, fixed in `15.10.16`, `16.4.6`, `16.10.1` · CVSS 8.6 High · Not analysed yet · Published 23 Apr 2025 · Tags: SQL injection
- [XSS in the /download Endpoint of the JPA Web API](https://agentprime.io/advisories/GHSA-hg25-w3vg-7279.md)
  `GHSA-hg25-w3vg-7279`, `CVE-2025-32961` · Maven `com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 6.4 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Cross-site scripting (XSS)
- [XSS in the /files Endpoint of the Generic REST API](https://agentprime.io/advisories/GHSA-88h5-34xw-2q56.md)
  `GHSA-88h5-34xw-2q56`, `CVE-2025-32960` · Maven `com.haulmont.addon.restapi:restapi-rest-api`: affected `<7.2.7`, fixed in `7.2.7` · CVSS 6.4 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Cuba has a DoS in the File Storage](https://agentprime.io/advisories/GHSA-w3mp-6vrj-875g.md)
  `GHSA-w3mp-6vrj-875g`, `CVE-2025-32959` · Maven `com.haulmont.cuba:cuba-core`: affected `<7.2.23`, fixed in `7.2.23` · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Denial of service
- [io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage](https://agentprime.io/advisories/GHSA-f3gv-cwwh-758m.md)
  `GHSA-f3gv-cwwh-758m`, `CVE-2025-32952` · Maven `io.jmix.localfs:jmix-localfs`: affected `>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0`, fixed in `1.6.2`, `2.4.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Denial of service
- [io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API](https://agentprime.io/advisories/GHSA-x27v-f838-jh93.md)
  `GHSA-x27v-f838-jh93`, `CVE-2025-32951` · Maven `io.jmix.rest:jmix-rest`: affected `>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0`, fixed in `1.6.2`, `2.4.0` · CVSS 6.4 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Cross-site scripting (XSS)
- [io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage](https://agentprime.io/advisories/GHSA-jx4g-3xqm-62vh.md)
  `GHSA-jx4g-3xqm-62vh`, `CVE-2025-32950` · Maven `io.jmix.localfs:jmix-localfs`: affected `>=1.0.0, <1.6.2 || >=2.0.0, <2.4.0`, fixed in `1.6.2`, `2.4.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2025 · Tags: Path traversal
- [OpenCMS Cross-Site Scripting vulnerability](https://agentprime.io/advisories/GHSA-h75c-f2xx-9vxv.md)
  `GHSA-h75c-f2xx-9vxv`, `CVE-2024-42699` · Maven `org.opencms:opencms-core`: affected `<=17.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: Cross-site scripting (XSS)
- [MCMS allows arbitrary file uploads in the ueditor component](https://agentprime.io/advisories/GHSA-3922-2r6r-r4fv.md)
  `GHSA-3922-2r6r-r4fv`, `CVE-2025-29287` · Maven `net.mingsoft:ms-mcms`: affected `<5.4.4`, fixed in `5.4.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2025 · Tags: Unrestricted file upload
- [OpenCMS cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-7m3w-m5g3-cc88.md)
  `GHSA-7m3w-m5g3-cc88`, `CVE-2024-41446` · Maven `org.opencms:opencms-core`: affected `<=17.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-vq95-6x79-qv8j.md)
  `GHSA-vq95-6x79-qv8j`, `CVE-2024-41447` · Maven `org.opencms:opencms-core`: affected `<=17.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 18 Apr 2025 · Tags: Cross-site scripting (XSS)
- [OpenMetadata SQL Injection](https://agentprime.io/advisories/GHSA-x8pm-wrg2-mqmx.md)
  `GHSA-x8pm-wrg2-mqmx`, `CVE-2024-55238` · Maven `org.open-metadata:openmetadata-service`: affected `<=1.4.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2025 · Tags: SQL injection
- [Liferay Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-qhp6-vp7c-g7xp.md)
  `GHSA-qhp6-vp7c-g7xp`, `CVE-2025-3760` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=7.2.10.fp1, <=7.2.10.fp20 || >=7.3.10.ep1, <=7.3.10.u36 || >=7.4.13.u1, <=7.4.13.u92 || >=2023.Q3.1, <=2023.Q3.10 || >=2023.Q4.0, <=2023.Q4.10 || >=2024.Q1.1, <2024.Q1.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q3.1, <2024.Q3.10 || >=2024.Q4.1, <2025.Q1.0 || >=7.2.10, <=7.2.10.8 || >=7.3.10.0, <=7.3.10.3`, fixed in `2024.Q1.13`, `2024.Q3.10`, `2025.Q1.0` · CVSS 4.8 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Unregistered users can see "public" messages from a closed wiki via notifications from a different wiki](https://agentprime.io/advisories/GHSA-42fh-pvvh-999x.md)
  `GHSA-42fh-pvvh-999x`, `CVE-2025-32783` · Maven `org.xwiki.platform:xwiki-platform-messagestream`: affected `>=5.0, <=16.7.1`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: Information disclosure
- [jsonschema2pojo has Improper Restriction of Operations within the Bounds of a Memory Buffer](https://agentprime.io/advisories/GHSA-66rc-vg9f-48m7.md)
  `GHSA-66rc-vg9f-48m7`, `CVE-2025-3588` · Maven `org.jsonschema2pojo:jsonschema2pojo-core`: affected `<=1.2.2`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Memory corruption
- [Apache ActiveMQ Artemis Vulnerable to Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/GHSA-pm4j-p7pm-fpvx.md)
  `GHSA-pm4j-p7pm-fpvx`, `CVE-2025-27391` · Maven `org.apache.activemq:artemis-project`: affected `>=1.5.1, <2.40.0`, fixed in `2.40.0` · CVSS 6.8 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Information disclosure
- [Apache Pulsar Kafka Connector Logs Sensitive Information in Application Logs](https://agentprime.io/advisories/GHSA-rcqj-3fmp-5cqx.md)
  `GHSA-rcqj-3fmp-5cqx`, `CVE-2025-30677` · Maven `org.apache.pulsar:pulsar-io-kafka` and 1 more: affected `<3.0.11 || >=3.3.0, <3.3.6 || >=4.0.0, <4.0.4`, fixed in `3.0.11`, `3.3.6`, `4.0.4` · CVSS 6.3 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Information disclosure
- [Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing](https://agentprime.io/advisories/GHSA-gmg8-593g-7mv3.md)
  `GHSA-gmg8-593g-7mv3`, `CVE-2025-31672` · Maven `org.apache.poi:poi-ooxml`: affected `<5.4.0`, fixed in `5.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-20
- [Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion](https://agentprime.io/advisories/GHSA-5xm9-x7x4-4j5x.md)
  `GHSA-5xm9-x7x4-4j5x`, `BIT-elasticsearch-2024-52981`, `CVE-2024-52981` · Maven `org.elasticsearch:elasticsearch`: affected `>=7.17.0, <7.17.24 || >=8.0.0-alpha1, <8.15.1`, fixed in `7.17.24`, `8.15.1` · CVSS 4.9 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Denial of service
- [Elasticsearch-grok Potential Node Crash due to Large Recursion in \`innerForbidCircularReferences\` Function](https://agentprime.io/advisories/GHSA-ghfh-p92w-j4mg.md)
  `GHSA-ghfh-p92w-j4mg`, `BIT-elasticsearch-2024-52980`, `CVE-2024-52980` · Maven `org.elasticsearch:elasticsearch-grok`: affected `>=7.17.0, <8.15.1`, fixed in `8.15.1` · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Denial of service
- [Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value](https://agentprime.io/advisories/GHSA-q7g5-jq6p-6wvx.md)
  `GHSA-q7g5-jq6p-6wvx`, `CVE-2025-30373` · Maven `org.graylog2:graylog2-server`: affected `>=6.1.0, <6.1.9`, fixed in `6.1.9` · CVSS 6.5 Medium · Not analysed yet · Published 7 Apr 2025 · Tags: Broken access control
- [The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server](https://agentprime.io/advisories/GHSA-wc53-4255-gw3f.md)
  `GHSA-wc53-4255-gw3f`, `CVE-2025-31487` · Maven `org.xwiki.contrib.jira:jira-macro-default`: affected `>=4.2, <8.5.6`, fixed in `8.5.6` · CVSS 7.7 High · Not analysed yet · Published 4 Apr 2025 · Tags: XML external entities (XXE)
- [Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component](https://agentprime.io/advisories/GHSA-49v8-p6mm-3pfj.md)
  `GHSA-49v8-p6mm-3pfj`, `CVE-2025-29085` · Maven `com.vip.saturn:saturn-console`: affected `<=3.5.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 2 Apr 2025 · Tags: SQL injection
- [Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted](https://agentprime.io/advisories/GHSA-x9hj-q7xv-fv4v.md)
  `GHSA-x9hj-q7xv-fv4v`, `CVE-2025-31724` · Maven `org.jenkins-ci.plugins:vmanager-plugin`: affected `<4.0.1`, fixed in `4.0.1` · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Information disclosure, CWE-256
- [Jenkins Missing Permission Check](https://agentprime.io/advisories/GHSA-wr6w-jxg7-qpfh.md)
  `GHSA-wr6w-jxg7-qpfh`, `BIT-jenkins-2025-31721`, `CVE-2025-31721` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.500, <2.504 || <2.492.3`, fixed in `2.504`, `2.492.3` · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Broken access control
- [Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form](https://agentprime.io/advisories/GHSA-m254-f6h4-p93g.md)
  `GHSA-m254-f6h4-p93g`, `CVE-2025-31728` · Maven `org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin`: affected `<=0.1.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Weak cryptography or TLS, CWE-549
- [Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)](https://agentprime.io/advisories/GHSA-hcfh-qjcp-34q9.md)
  `GHSA-hcfh-qjcp-34q9`, `CVE-2025-31723` · Maven `io.jenkins.plugins:simple-queue`: affected `<1.4.7`, fixed in `1.4.7` · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted](https://agentprime.io/advisories/GHSA-g65g-fmcp-4w68.md)
  `GHSA-g65g-fmcp-4w68`, `CVE-2025-31725` · Maven `org.ukiuni.monitor-remote-job-plugin:monitor-remote-job`: affected `=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Broken access control, Information disclosure
- [Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job \`config.xml\` Files](https://agentprime.io/advisories/GHSA-fv9q-fq62-c6qg.md)
  `GHSA-fv9q-fq62-c6qg`, `CVE-2025-31727` · Maven `org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin`: affected `<=0.1.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Information disclosure, CWE-549
- [Jenkins Missing Permission Check](https://agentprime.io/advisories/GHSA-565r-pf5q-45v6.md)
  `GHSA-565r-pf5q-45v6`, `BIT-jenkins-2025-31720`, `CVE-2025-31720` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.500, <2.504 || <2.492.3`, fixed in `2.504`, `2.492.3` · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA0LTAyVDE1OjMxOjM4LjAwMDAwMFoiLCJHSFNBLTU2NXItcGY1cS00NXY2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA1LTA4VDE5OjI4OjM0LjAwMDAwMFoiLCJHSFNBLXE0cnYtZ3E5Ni13N2M1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA1LTA4VDE5OjI4OjM0LjAwMDAwMFoiLCJHSFNBLXE0cnYtZ3E5Ni13N2M1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.