# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Liferay Portal does not limit the depth of a GraphQL queries](https://agentprime.io/advisories/GHSA-8c26-xm99-53w7.md)
  `GHSA-8c26-xm99-53w7`, `CVE-2025-3602` · Maven `com.liferay:com.liferay.portal.vulcan.impl`: affected `<5.0.103`, fixed in `5.0.103` · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2025 · Tags: Denial of service
- [XWiki does not require right warnings for XClass definitions](https://agentprime.io/advisories/GHSA-59w6-r9hm-439h.md)
  `GHSA-59w6-r9hm-439h`, `CVE-2025-49585` · Maven `org.xwiki.platform:xwiki-platform-security-requiredrights-default`: affected `<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 8.6 High · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [XWiki allows remote code execution through preview of XClass changes in AWM editor](https://agentprime.io/advisories/GHSA-jp4x-w9cj-97q7.md)
  `GHSA-jp4x-w9cj-97q7`, `CVE-2025-49586` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=7.2-milestone-2, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0`, fixed in `16.4.7`, `16.10.3`, `17.0.0` · CVSS 8.7 High · Not analysed yet · Published 13 Jun 2025 · Tags: Broken access control
- [XWiki does not require right warnings for notification displayer objects](https://agentprime.io/advisories/GHSA-j7p2-87q3-44w7.md)
  `GHSA-j7p2-87q3-44w7`, `CVE-2025-49587` · Maven `org.xwiki.platform:xwiki-platform-notifications-notifiers-default`: affected `>=15.9-rc-1, <15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 6.4 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [XWiki makes title of inaccessible pages available through the class property values REST API](https://agentprime.io/advisories/GHSA-mvp5-qx9c-c3fv.md)
  `GHSA-mvp5-qx9c-c3fv`, `CVE-2025-49584` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=10.9, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0`, fixed in `16.4.7`, `16.10.3`, `17.0.0` · CVSS 8.7 High · Not analysed yet · Published 13 Jun 2025 · Tags: Information disclosure
- [XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right](https://agentprime.io/advisories/GHSA-ff6v-w58f-v97w.md)
  `GHSA-ff6v-w58f-v97w`, `CVE-2025-49583` · Maven `org.xwiki.platform:xwiki-platform-notifications-notifiers-default`: affected `<15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 5.1 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Privilege escalation, CWE-357
- [XWiki allows remote code execution through default value of wiki macro wiki-type parameters](https://agentprime.io/advisories/GHSA-9875-cw22-f7cx.md)
  `GHSA-9875-cw22-f7cx`, `CVE-2025-49581` · Maven `org.xwiki.platform:xwiki-platform-rendering-wikimacro-store`: affected `>=11.10.11 || >=12.6.3 || >=12.8-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0`, fixed in `16.4.7`, `16.10.3`, `17.0.0` · CVSS 8.7 High · Not analysed yet · Published 13 Jun 2025 · Tags: Code injection, Privilege escalation
- [XWiki's required right warnings for macros are incomplete](https://agentprime.io/advisories/GHSA-c32m-27pj-4xcj.md)
  `GHSA-c32m-27pj-4xcj`, `CVE-2025-49582` · Maven `org.xwiki.platform:xwiki-platform-rendering-macro-cache` and 3 more: affected `>=15.9-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.3 || >=17.0.0-rc-1, <17.0.0`, fixed in `16.4.7`, `16.10.3`, `17.0.0` · CVSS 8.6 High · Not analysed yet · Published 13 Jun 2025 · Tags: CWE-357
- [XWiki allows privilege escalation through link refactoring](https://agentprime.io/advisories/GHSA-jm43-hrq7-r7w6.md)
  `GHSA-jm43-hrq7-r7w6`, `CVE-2025-49580` · Maven `org.xwiki.platform:xwiki-platform-refactoring-default`: affected `>=17.0.0-rc-1, <17.1.0-rc-1 || >=16.5.0-rc-1, <16.10.4 || >=8.2, <16.4.7 || >=7.4.5, <16.4.7`, fixed in `17.1.0-rc-1`, `16.10.4`, `16.4.7` · CVSS 8.5 High · Not analysed yet · Published 13 Jun 2025 · Tags: Privilege escalation
- [Solon Vulnerable to Directory Traversal](https://agentprime.io/advisories/GHSA-m63q-4hr8-5r5h.md)
  `GHSA-m63q-4hr8-5r5h`, `CVE-2025-46096` · Maven `org.noear:solon-faas-luffy`: affected `>=3.1.2, <3.2.0`, fixed in `3.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Path traversal, Cross-site scripting (XSS)
- [Spring Framework vulnerable to a reflected file download (RFD)](https://agentprime.io/advisories/GHSA-6r3c-xf4w-jxjm.md)
  `GHSA-6r3c-xf4w-jxjm`, `CVE-2025-41234` · Maven `org.springframework:spring-web`: affected `>=6.2.0, <6.2.8 || >=6.1.0, <6.1.21 || >=6.0.5, <=6.0.23`, fixed in `6.2.8`, `6.1.21` · CVSS 6.5 Medium · Not analysed yet · Published 13 Jun 2025 · Tags: Other injection
- [XWiki allows SQL injection in query endpoint of REST API with Oracle](https://agentprime.io/advisories/GHSA-prwh-7838-xf82.md)
  `GHSA-prwh-7838-xf82`, `CVE-2024-56158` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=1.0, <15.10.16 || >=16.0.0-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.2`, fixed in `15.10.16`, `16.4.7`, `16.10.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2025 · Tags: SQL injection
- [pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration](https://agentprime.io/advisories/GHSA-hq9p-pm7w-8p54.md)
  `GHSA-hq9p-pm7w-8p54`, `BIT-postgresql-jdbc-driver-2025-49146`, `CVE-2025-49146` · Maven `org.postgresql:postgresql`: affected `>=42.7.4, <42.7.7`, fixed in `42.7.7` · CVSS 8.2 High · Not analysed yet · Published 11 Jun 2025 · Tags: Authentication bypass
- [GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx](https://agentprime.io/advisories/GHSA-68cf-j696-wvv9.md)
  `GHSA-68cf-j696-wvv9` · Maven `org.geoserver:gs-wfs`: affected `>=1.0.0, <2.24.4 || >=2.25.0, <2.25.2`, fixed in `2.24.4`, `2.25.2` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint](https://agentprime.io/advisories/GHSA-2p76-gc46-5fvc.md)
  `GHSA-2p76-gc46-5fvc` · Maven `org.geonetwork-opensource:gn-web-app` and 1 more: affected `>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13`, fixed in `4.4.8`, `4.2.13` · CVSS 8.2 High · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [\[XBOW-025-068\] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://agentprime.io/advisories/GHSA-jj54-8f66-c5pc.md)
  `GHSA-jj54-8f66-c5pc`, `CVE-2025-30220` · Maven `org.geoserver:gs-wfs` and 1 more: affected `>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7`, fixed in `2.27.1`, `2.26.3`, `2.25.7` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.44 · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [GeoServer Infinite Loop Vulnerability in Jiffle process](https://agentprime.io/advisories/GHSA-gr67-pwcv-76gf.md)
  `GHSA-gr67-pwcv-76gf`, `CVE-2025-30145` · Maven `org.geoserver.extension:gs-wps-core` and 2 more: affected `>=2.26.0, <2.26.3 || <2.25.7`, fixed in `2.26.3`, `2.25.7` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Denial of service
- [GeoServer Missing Authorization on REST API Index](https://agentprime.io/advisories/GHSA-h86g-x8mm-78m5.md)
  `GHSA-h86g-x8mm-78m5`, `CVE-2025-27505` · Maven `org.geoserver:gs-rest` and 1 more: affected `>=2.26.0, <2.26.3 || <2.25.6`, fixed in `2.26.3`, `2.25.6` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Broken access control
- [Coverage REST API Server Side Request Forgery](https://agentprime.io/advisories/GHSA-r4hf-r8gj-jgw2.md)
  `GHSA-r4hf-r8gj-jgw2`, `CVE-2024-40625` · Maven `org.geoserver:gs-rest` and 1 more: affected `<2.26.0`, fixed in `2.26.0` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [GWC Home Page communicate version and revision information](https://agentprime.io/advisories/GHSA-jm79-7xhw-6f6f.md)
  `GHSA-jm79-7xhw-6f6f`, `CVE-2024-38524` · Maven `org.geoserver:gs-gwc` and 1 more: affected `>=2.26.0, <2.26.2 || <2.25.6`, fixed in `2.26.2`, `2.25.6` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure
- [GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)](https://agentprime.io/advisories/GHSA-mc43-4fqr-c965.md)
  `GHSA-mc43-4fqr-c965`, `CVE-2024-34711` · Maven `org.geoserver.main:gs-main` and 1 more: affected `<2.25.0`, fixed in `2.25.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure, XML external entities (XXE), Server-side request forgery (SSRF), CWE-20
- [GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost](https://agentprime.io/advisories/GHSA-5gw5-jccf-6hxw.md)
  `GHSA-5gw5-jccf-6hxw`, `CVE-2024-29198` · Maven `org.geoserver:gs-wfs` and 1 more: affected `>=2.0.0, <2.24.4 || >=2.25.0, <2.25.2`, fixed in `2.24.4`, `2.25.2` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability](https://agentprime.io/advisories/GHSA-vgq5-3255-v292.md)
  `GHSA-vgq5-3255-v292`, `BIT-kafka-2025-27817`, `CVE-2025-27817` · Maven `org.apache.kafka:kafka-clients`: affected `>=3.1.0, <3.9.1`, fixed in `3.9.1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.70 · Not analysed yet · Published 10 Jun 2025 · Tags: Server-side request forgery (SSRF)
- [Apache Kafka Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-mcwh-c9pg-xw43.md)
  `GHSA-mcwh-c9pg-xw43`, `BIT-kafka-2025-27819`, `CVE-2025-27819` · Maven `org.apache.kafka:kafka_2.10` and 7 more: affected `*`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Insecure deserialization
- [Apache Kafka Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-76qp-h5mr-frr4.md)
  `GHSA-76qp-h5mr-frr4`, `BIT-kafka-2025-27818`, `CVE-2025-27818` · Maven `org.apache.kafka:kafka_2.11` and 2 more: affected `>=2.3.0, <=2.4.1`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Insecure deserialization
- [GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling](https://agentprime.io/advisories/GHSA-826p-4gcg-35vw.md)
  `GHSA-826p-4gcg-35vw` · Maven `org.geotools:gt-wfs-ng` and 1 more: affected `>=33.0, <33.1 || >=32.0, <32.3 || >=29.0, <31.7 || <28.6.1`, fixed in `33.1`, `32.3`, `31.7`, `28.6.1` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2025 · Tags: XML external entities (XXE)
- [Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation](https://agentprime.io/advisories/GHSA-wf8f-6423-gfxg.md)
  `GHSA-wf8f-6423-gfxg`, `CVE-2025-49128` · Maven `com.fasterxml.jackson.core:jackson-core`: affected `>=2.0.0, <2.13.0`, fixed in `2.13.0` · CVSS 4.0 Medium · Not analysed yet · Published 7 Jun 2025 · Tags: Information disclosure
- [Para Inserts Sensitive Information into Log File for Facebook authentication](https://agentprime.io/advisories/GHSA-qx7g-fx8q-545g.md)
  `GHSA-qx7g-fx8q-545g`, `CVE-2025-49009` · Maven `com.erudika:para-server`: affected `<1.50.8`, fixed in `1.50.8` · CVSS 6.2 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Information disclosure
- [Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-gw97-cqwg-xmh4.md)
  `GHSA-gw97-cqwg-xmh4`, `CVE-2025-5806` · Maven `org.jenkins-ci.plugins:gatling`: affected `=136.vb`, no fixed version yet · CVSS 8.0 High · Not analysed yet · Published 6 Jun 2025 · Tags: Cross-site scripting (XSS)
- [Apache InLong Deserialization of Untrusted Data Vulnerability](https://agentprime.io/advisories/GHSA-62gc-8jr5-x9pm.md)
  `GHSA-62gc-8jr5-x9pm`, `CVE-2025-27531` · Maven `org.apache.inlong:inlong-manager`: affected `>=1.13.0, <2.1.0`, fixed in `2.1.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2025 · Tags: Insecure deserialization
- [Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language](https://agentprime.io/advisories/GHSA-7v6m-28jr-rg84.md)
  `GHSA-7v6m-28jr-rg84`, `CVE-2025-35036` · Maven `org.hibernate:hibernate-validator` and 1 more: affected `<6.2.0.CR1 || >=7.0.0.Alpha1, <7.0.0.CR1`, fixed in `6.2.0.CR1`, `7.0.0.CR1` · CVSS 6.9 Medium · Not analysed yet · Published 3 Jun 2025 · Tags: Code injection
- [Pekko Management may not properly apply authenticator when Basic Authentication is enabled](https://agentprime.io/advisories/GHSA-9qvj-rpj8-v5c8.md)
  `GHSA-9qvj-rpj8-v5c8`, `CVE-2025-46548` · Maven `com.lightbend.akka.management:akka-management_2.12` and 5 more: affected `<1.6.1`, fixed in `1.6.1` · CVSS 6.5 Medium · Not analysed yet · Published 3 Jun 2025 · Tags: Authentication bypass
- [Erupt Unrestricted Upload of File with Dangerous Type vulnerability](https://agentprime.io/advisories/GHSA-5gr5-vmmr-82g6.md)
  `GHSA-5gr5-vmmr-82g6`, `CVE-2025-45855` · Maven `xyz.erupt:erupt`: affected `<=1.12.19`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 3 Jun 2025 · Tags: Unrestricted file upload
- [WSO2 products vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-xpxp-r8hf-wgf6.md)
  `GHSA-xpxp-r8hf-wgf6`, `CVE-2024-8008` · Maven `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui`: affected `<7.5.12`, fixed in `7.5.12` · CVSS 5.2 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Cross-site scripting (XSS)
- [WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint](https://agentprime.io/advisories/GHSA-cp5v-2hmc-3vjx.md)
  `GHSA-cp5v-2hmc-3vjx`, `CVE-2024-1440` · Maven `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util`: affected `>=6.0.0, <7.0.111 || <5.25.707`, fixed in `7.0.111`, `5.25.707` · CVSS 5.4 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Open redirect
- [Para Server Logs Sensitive Information](https://agentprime.io/advisories/GHSA-v75g-77vf-6jjq.md)
  `GHSA-v75g-77vf-6jjq`, `CVE-2025-48955` · Maven `com.erudika:para-server`: affected `<1.50.8`, fixed in `1.50.8` · CVSS 6.2 Medium · Not analysed yet · Published 30 May 2025 · Tags: Information disclosure
- [WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services](https://agentprime.io/advisories/GHSA-j63j-7r7r-5v4j.md)
  `GHSA-j63j-7r7r-5v4j`, `CVE-2024-7096` · Maven `org.wso2.am:am-parent` and 1 more: affected `>=2.0.0, <4.4.0`, fixed in `4.4.0` · CVSS 4.2 Medium · Not analysed yet · Published 30 May 2025 · Tags: Broken access control
- [Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies](https://agentprime.io/advisories/GHSA-6j2q-c73v-97c5.md)
  `GHSA-6j2q-c73v-97c5`, `CVE-2025-41235` · Maven `org.springframework.cloud:spring-cloud-gateway-server` and 1 more: affected `>=4.2.0, <4.2.3 || >=4.1.0, <4.1.8 || >=4.0.0, <=4.0.9 || <3.1.10`, fixed in `4.2.3`, `4.1.8`, `3.1.10` · CVSS 8.6 High · Not analysed yet · Published 30 May 2025 · Tags: HTTP request smuggling
- [Apache Tomcat - CGI security constraint bypass](https://agentprime.io/advisories/GHSA-h2fw-rfh5-95r3.md)
  `GHSA-h2fw-rfh5-95r3`, `BIT-tomcat-2025-46701`, `CVE-2025-46701` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.0.M1, <9.0.105 || >=10.1.0-M1, <10.1.41 || >=11.0.0-M1, <11.0.7 || >=8.5.0, <=8.5.100`, fixed in `9.0.105`, `10.1.41`, `11.0.7` · CVSS 7.3 High · Not analysed yet · Published 29 May 2025 · Tags: CWE-178
- [Apache Commons Improper Access Control vulnerability](https://agentprime.io/advisories/GHSA-wxr5-93ph-8wr9.md)
  `GHSA-wxr5-93ph-8wr9`, `CVE-2025-48734` · Maven `commons-beanutils:commons-beanutils` and 1 more: affected `>=1.0, <1.11.0`, fixed in `1.11.0` · CVSS 8.8 High · Not analysed yet · Published 28 May 2025 · Tags: Broken access control
- [Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users](https://agentprime.io/advisories/GHSA-965r-9cg9-g42p.md)
  `GHSA-965r-9cg9-g42p`, `CVE-2025-48881` · Maven `com.ritense.valtimo:objecten-api` and 1 more: affected `>=11.0.0.RELEASE, <=11.3.3.RELEASE || >=12.0.0.RELEASE, <12.13.0.RELEASE`, fixed in `12.13.0.RELEASE` · CVSS 8.3 High · Not analysed yet · Published 28 May 2025 · Tags: Broken access control
- [Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read](https://agentprime.io/advisories/GHSA-98v7-xxxv-hcrh.md)
  `GHSA-98v7-xxxv-hcrh`, `CVE-2025-27528` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.13.0, <2.2.0`, fixed in `2.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2025 · Tags: Insecure deserialization
- [Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass](https://agentprime.io/advisories/GHSA-532x-j9r7-8f73.md)
  `GHSA-532x-j9r7-8f73`, `CVE-2025-27526` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.13.0, <2.2.0`, fixed in `2.2.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2025 · Tags: Insecure deserialization
- [Apache InLong: JDBC Vulnerability during verification processing](https://agentprime.io/advisories/GHSA-r324-vgr5-73c9.md)
  `GHSA-r324-vgr5-73c9`, `CVE-2025-27522` · Maven `org.apache.inlong:manager-pojo`: affected `>=1.13.0, <2.2.0`, fixed in `2.2.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2025 · Tags: Insecure deserialization
- [Fess has Insecure Temporary File Permissions](https://agentprime.io/advisories/GHSA-g88v-2j67-9rmx.md)
  `GHSA-g88v-2j67-9rmx`, `CVE-2025-48382` · Maven `org.codelibs.fess:fess`: affected `<14.19.2`, fixed in `14.19.2` · CVSS 1.2 Low · Not analysed yet · Published 27 May 2025 · Tags: Broken access control
- [Eclipse JGit XML External Entity (XXE) Vulnerability](https://agentprime.io/advisories/GHSA-vrpq-qp53-qv56.md)
  `GHSA-vrpq-qp53-qv56`, `CVE-2025-4949` · Maven `org.eclipse.jgit:org.eclipse.jgit`: affected `>=7.2.0.202503040940-r, <7.2.1.202505142326-r || >=7.1.0.202411261347-r, <7.1.1.202505221757-r || >=7.0.0.202409031743-r, <7.0.1.202505221510-r || >=6.1.0.202203080745-r, <6.10.1.202505221210-r || >=6.0.0.202110060947-m1, <6.0.0.202111291000-r || <5.13.4.202507202350-r`, fixed in `7.2.1.202505142326-r`, `7.1.1.202505221757-r`, `7.0.1.202505221510-r`, `6.10.1.202505221210-r`, `6.0.0.202111291000-r`, `5.13.4.202507202350-r` · CVSS 6.8 Medium · Not analysed yet · Published 21 May 2025 · Tags: XML external entities (XXE)
- [XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right](https://agentprime.io/advisories/GHSA-rhfv-688c-p6hp.md)
  `GHSA-rhfv-688c-p6hp`, `CVE-2025-48063` · Maven `org.xwiki.platform:xwiki-platform-security-authorization-bridge`: affected `>=16.10.0-rc-1, <16.10.4 || >=17.0.0-rc-1, <17.1.0-rc-1`, fixed in `16.10.4`, `17.1.0-rc-1` · CVSS 4.8 Medium · Not analysed yet · Published 21 May 2025 · Tags: Broken access control
- [Spring Security authorization bypass for method security annotations on private methods](https://agentprime.io/advisories/GHSA-9pp5-9c7g-4r83.md)
  `GHSA-9pp5-9c7g-4r83`, `CVE-2025-41232` · Maven `org.springframework.security:spring-security-aspects` and 1 more: affected `>=6.4.0, <6.4.6`, fixed in `6.4.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2025 · Tags: CWE-693
- [Spring Framework DataBinder Case Sensitive Match Exception](https://agentprime.io/advisories/GHSA-4wp7-92pw-q264.md)
  `GHSA-4wp7-92pw-q264`, `CVE-2025-22233` · Maven `org.springframework:spring-context`: affected `>=6.2.0, <6.2.7 || >=6.1.0, <6.1.20 || >=6.0.0, <=6.0.23 || <=5.3.39`, fixed in `6.2.7`, `6.1.20` · CVSS 3.1 Low · Not analysed yet · Published 16 May 2025 · Tags: CWE-20
- [Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-xrpq-4g9w-qrwj.md)
  `GHSA-xrpq-4g9w-qrwj`, `CVE-2025-47885` · Maven `org.jenkins-ci.plugins:cloudbees-jenkins-advisor`: affected `<374.376.v3a_41a_a_142efe`, fixed in `374.376.v3a_41a_a_142efe` · CVSS 8.8 High · Not analysed yet · Published 14 May 2025 · Tags: Cross-site scripting (XSS)
- [Jenkins Cadence vManager Plugin is Missing Permission Checks](https://agentprime.io/advisories/GHSA-rf73-97j8-9vqh.md)
  `GHSA-rf73-97j8-9vqh`, `CVE-2025-47887` · Maven `org.jenkins-ci.plugins:vmanager-plugin`: affected `<4.0.1-288.v8804b_ea_a_cb_7f`, fixed in `4.0.1-288.v8804b_ea_a_cb_7f` · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2025 · Tags: Broken access control
- [Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens](https://agentprime.io/advisories/GHSA-q7c3-x7hm-qq72.md)
  `GHSA-q7c3-x7hm-qq72`, `CVE-2025-47884` · Maven `io.jenkins.plugins:oidc-provider`: affected `<111.v29fd614b_3617`, fixed in `111.v29fd614b_3617` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2025 · Tags: Broken access control
- [Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials](https://agentprime.io/advisories/GHSA-p89h-p4ph-4vj6.md)
  `GHSA-p89h-p4ph-4vj6`, `CVE-2025-47889` · Maven `org.jenkins-ci.plugins:wso2id-oauth`: affected `<=1.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2025 · Tags: Authentication bypass
- [Jenkins DingTalk Plugin Unconditionally Disables SSL/TLS Certificate and Hostname Validation](https://agentprime.io/advisories/GHSA-cp9r-g575-xc5f.md)
  `GHSA-cp9r-g575-xc5f`, `CVE-2025-47888` · Maven `io.jenkins.plugins:dingding-notifications`: affected `<=2.7.3`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2025 · Tags: CWE-20
- [Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-5w52-96jj-fv59.md)
  `GHSA-5w52-96jj-fv59`, `CVE-2025-47886` · Maven `org.jenkins-ci.plugins:vmanager-plugin`: affected `<4.0.1-288.v8804b_ea_a_cb_7f`, fixed in `4.0.1-288.v8804b_ea_a_cb_7f` · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2025 · Tags: Cross-site request forgery (CSRF)
- [BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-pwm3-776c-8q7q.md)
  `GHSA-pwm3-776c-8q7q`, `CVE-2025-4641` · Maven `io.github.bonigarcia:webdrivermanager`: affected `>=1.0.0, <6.1.0`, fixed in `6.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2025 · Tags: XML external entities (XXE)
- [Apache IoTDB JDBC Driver Discloses Sensitive Information via Log Files](https://agentprime.io/advisories/GHSA-gp98-hfvm-2r4x.md)
  `GHSA-gp98-hfvm-2r4x`, `CVE-2025-26795` · Maven `org.apache.iotdb:iotdb-jdbc`: affected `>=0.10.0, <1.3.4 || >=2.0.1-beta, <2.0.2`, fixed in `1.3.4`, `2.0.2` · CVSS 7.5 High · Not analysed yet · Published 14 May 2025 · Tags: Information disclosure
- [Apache Commons Configuration Uncontrolled Resource Consumption](https://agentprime.io/advisories/GHSA-pvp8-3xj6-8c6x.md)
  `GHSA-pvp8-3xj6-8c6x`, `CVE-2025-46392` · Maven `commons-configuration:commons-configuration`: affected `<=1.10`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 9 May 2025 · Tags: Denial of service
- [Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit](https://agentprime.io/advisories/GHSA-889j-63jv-qhr8.md)
  `GHSA-889j-63jv-qhr8`, `CVE-2025-1948` · Maven `org.eclipse.jetty.http2:jetty-http2-common`: affected `>=12.0.0, <12.0.17`, fixed in `12.0.17` · CVSS 7.5 High · Not analysed yet · Published 8 May 2025 · Tags: Denial of service
- [\*\*UNSUPPORTED WHEN ASSIGNED\*\* GzipHandler causes part of request body to be seen as request body of a separate request](https://agentprime.io/advisories/GHSA-q4rv-gq96-w7c5.md)
  `GHSA-q4rv-gq96-w7c5`, `CVE-2024-13009` · Maven `org.eclipse.jetty:jetty-server`: affected `>=9.4.0, <9.4.57.v20241219`, fixed in `9.4.57.v20241219` · CVSS 7.2 High · Not analysed yet · Published 8 May 2025 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA1LTA4VDE5OjI4OjM0LjAwMDAwMFoiLCJHSFNBLXE0cnYtZ3E5Ni13N2M1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA2LTE2VDE1OjMyOjI4LjAwMDAwMFoiLCJHSFNBLTQyd2ctaG02Mi1qY3dnIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA2LTE2VDE1OjMyOjI4LjAwMDAwMFoiLCJHSFNBLTQyd2ctaG02Mi1qY3dnIl0>. Everything for agents: <https://agentprime.io/llms.txt>.