# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits](https://agentprime.io/advisories/GHSA-wr62-c79q-cv37.md)
  `GHSA-wr62-c79q-cv37`, `BIT-tomcat-2025-52520`, `CVE-2025-52520` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.9 || >=10.1.0-M1, <10.1.43 || >=9.0.0.M1, <9.0.107 || >=8.5.0, <=8.5.100`, fixed in `11.0.9`, `10.1.43`, `9.0.107` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Memory corruption
- [Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector](https://agentprime.io/advisories/GHSA-4j3c-42xv-3f84.md)
  `GHSA-4j3c-42xv-3f84`, `BIT-tomcat-2025-52434`, `CVE-2025-52434` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.0.M1, <9.0.107 || >=8.5.0, <=8.5.100`, fixed in `9.0.107` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Race condition
- [Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow](https://agentprime.io/advisories/GHSA-gj52-35xm-gxjh.md)
  `GHSA-gj52-35xm-gxjh` · Maven `org.keycloak:keycloak-services`: affected `<26.3.0`, fixed in `26.3.0` · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-346
- [Jenkins User1st uTester Plugin vulnerability exposes unencrypted token to authenticated users](https://agentprime.io/advisories/GHSA-w4xv-mj6v-p4g2.md)
  `GHSA-w4xv-mj6v-p4g2`, `CVE-2025-53678` · Maven `io.jenkins.plugins:user1st-utester`: affected `<=1.1`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS
- [Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users](https://agentprime.io/advisories/GHSA-q92v-3f4w-5xg8.md)
  `GHSA-q92v-3f4w-5xg8`, `CVE-2025-53742` · Maven `org.jenkins-ci.plugins:applitools-eyes`: affected `<=1.16.5`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Information disclosure
- [Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form](https://agentprime.io/advisories/GHSA-jmrv-rxgr-phvr.md)
  `GHSA-jmrv-rxgr-phvr`, `CVE-2025-53743` · Maven `org.jenkins-ci.plugins:applitools-eyes`: affected `<=1.16.5`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials
- [Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form](https://agentprime.io/advisories/GHSA-8gp3-m447-gw2v.md)
  `GHSA-8gp3-m447-gw2v`, `CVE-2025-53669` · Maven `org.jenkins-ci.plugins:vaddy-plugin`: affected `<=1.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Xooa Plugin vulnerability exposes unencrypted tokens to authenticated users](https://agentprime.io/advisories/GHSA-56h7-r62c-83qp.md)
  `GHSA-56h7-r62c-83qp`, `CVE-2025-53676` · Maven `io.jenkins.plugins:xooa`: affected `<=0.0.7`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS
- [Jenkins Warrior Framework Plugin vulnerability exposes unencrypted passwords to certain authenticated users](https://agentprime.io/advisories/GHSA-2g8w-9933-36vr.md)
  `GHSA-2g8w-9933-36vr`, `CVE-2025-53675` · Maven `org.jenkins-ci.plugins:warrior`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token](https://agentprime.io/advisories/GHSA-23j7-px3w-jwp2.md)
  `GHSA-23j7-px3w-jwp2`, `CVE-2025-53677` · Maven `io.jenkins.plugins:xooa`: affected `<=0.0.7`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens](https://agentprime.io/advisories/GHSA-vx57-hphr-3mr9.md)
  `GHSA-vx57-hphr-3mr9`, `CVE-2025-53674` · Maven `org.jenkins-ci.plugins:sensedia-api-platform`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets](https://agentprime.io/advisories/GHSA-r496-x769-f8j4.md)
  `GHSA-r496-x769-f8j4`, `CVE-2025-53657` · Maven `org.jenkins-ci.plugins:soapui-pro-functional-testing`: affected `<=1.11`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials
- [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-q8p4-vw42-66gh.md)
  `GHSA-q8p4-vw42-66gh`, `CVE-2025-53664` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens](https://agentprime.io/advisories/GHSA-pgrx-5f8q-r5mq.md)
  `GHSA-pgrx-5f8q-r5mq`, `CVE-2025-53663` · Maven `com.ibm.devops:ibm-cloud-devops`: affected `<=2.0.16`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Jenkins QMetry Test Management Plugin stores unencrypted API keys](https://agentprime.io/advisories/GHSA-p9gh-rpjw-78qg.md)
  `GHSA-p9gh-rpjw-78qg`, `CVE-2025-53659` · Maven `org.jenkins-ci.plugins:qmetry-test-management`: affected `<=1.13`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS
- [Jenkins VAddy Plugin vulnerability exposes unencrypted keys to certain authenticated users](https://agentprime.io/advisories/GHSA-mr49-vmp6-2pwq.md)
  `GHSA-mr49-vmp6-2pwq`, `CVE-2025-53668` · Maven `org.jenkins-ci.plugins:vaddy-plugin`: affected `<=1.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS
- [Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens](https://agentprime.io/advisories/GHSA-m248-72rh-cpx4.md)
  `GHSA-m248-72rh-cpx4`, `CVE-2025-53667` · Maven `org.jenkins-ci.plugins:deadmanssnitch`: affected `<=0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials
- [Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys](https://agentprime.io/advisories/GHSA-jxwj-qccf-4896.md)
  `GHSA-jxwj-qccf-4896`, `CVE-2025-53662` · Maven `org.jenkins-ci.plugins:ifttt-build-notifier`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page](https://agentprime.io/advisories/GHSA-j4wf-9gx8-63f8.md)
  `GHSA-j4wf-9gx8-63f8`, `CVE-2025-53658` · Maven `org.jenkins-ci.plugins:applitools-eyes`: affected `<1.16.6`, fixed in `1.16.6` · CVSS 8.0 High · Not analysed yet · Published 9 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Jenkins Kryptowire Plugin vulnerability stores unencrypted Kryptowire API key](https://agentprime.io/advisories/GHSA-cvg7-767r-w3fq.md)
  `GHSA-cvg7-767r-w3fq`, `CVE-2025-53672` · Maven `io.jenkins.plugins:kryptowire`: affected `<=0.2`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Information disclosure
- [Jenkins QMetry Test Management Plugin vulnerability exposes API keys](https://agentprime.io/advisories/GHSA-962q-84v8-hxhj.md)
  `GHSA-962q-84v8-hxhj`, `CVE-2025-53660` · Maven `org.jenkins-ci.plugins:qmetry-test-management`: affected `<=1.13`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens in its global configuration file](https://agentprime.io/advisories/GHSA-93j6-jcjw-3rwp.md)
  `GHSA-93j6-jcjw-3rwp`, `CVE-2025-53673` · Maven `org.jenkins-ci.plugins:sensedia-api-platform`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS
- [Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form](https://agentprime.io/advisories/GHSA-8wp4-r84g-gcmw.md)
  `GHSA-8wp4-r84g-gcmw`, `CVE-2025-53661` · Maven `io.jenkins.plugins:testsigma`: affected `<=1.6`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials
- [Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials](https://agentprime.io/advisories/GHSA-884f-p57j-f258.md)
  `GHSA-884f-p57j-f258`, `CVE-2025-53656` · Maven `org.jenkins-ci.plugins:soapui-pro-functional-testing`: affected `<=1.11`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text](https://agentprime.io/advisories/GHSA-5pcv-7v3q-hw8j.md)
  `GHSA-5pcv-7v3q-hw8j`, `CVE-2025-53666` · Maven `org.jenkins-ci.plugins:deadmanssnitch`: affected `<=0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form](https://agentprime.io/advisories/GHSA-4v4v-92cx-x4f4.md)
  `GHSA-4v4v-92cx-x4f4`, `CVE-2025-53671` · Maven `org.jenkins-ci.plugins:nouvola-divecloud`: affected `<=1.08`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials](https://agentprime.io/advisories/GHSA-45hr-8gq6-7f7f.md)
  `GHSA-45hr-8gq6-7f7f`, `CVE-2025-53670` · Maven `org.jenkins-ci.plugins:nouvola-divecloud`: affected `<=1.08`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Information disclosure
- [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-28j3-hphh-cjr8.md)
  `GHSA-28j3-hphh-cjr8`, `CVE-2025-53665` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key](https://agentprime.io/advisories/GHSA-26x3-7jw5-7mg4.md)
  `GHSA-26x3-7jw5-7mg4`, `CVE-2025-53655` · Maven `org.jenkins.plugins.statistics.gatherer:statistics-gatherer`: affected `<=2.0.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check](https://agentprime.io/advisories/GHSA-qcj2-99cg-mppf.md)
  `GHSA-qcj2-99cg-mppf`, `CVE-2025-53652` · Maven `org.jenkins-ci.tools:git-parameter`: affected `<444.vca`, fixed in `444.vca` · CVSS 5.4 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-20, CWE-1287
- [Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens](https://agentprime.io/advisories/GHSA-3wgg-3j4j-3f69.md)
  `GHSA-3wgg-3j4j-3f69`, `CVE-2025-53653` · Maven `org.jenkins-ci.plugins:aqua-security-scanner`: affected `<=3.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials
- [Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key](https://agentprime.io/advisories/GHSA-3c9f-c64m-h4wc.md)
  `GHSA-3c9f-c64m-h4wc`, `CVE-2025-53654` · Maven `org.jenkins.plugins.statistics.gatherer:statistics-gatherer`: affected `<=2.0.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials
- [Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs](https://agentprime.io/advisories/GHSA-367v-5ppj-2hrx.md)
  `GHSA-367v-5ppj-2hrx`, `CVE-2025-53651` · Maven `org.jenkins-ci.plugins:htmlpublisher`: affected `<427`, fixed in `427` · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Path traversal, CWE-779
- [Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages](https://agentprime.io/advisories/GHSA-9768-hprv-crj5.md)
  `GHSA-9768-hprv-crj5`, `CVE-2025-53650` · Maven `org.jenkins-ci.plugins:credentials-binding`: affected `<687.689.v1a`, fixed in `687.689.v1a` · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-779
- [Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint](https://agentprime.io/advisories/GHSA-794x-8x6x-qpfc.md)
  `GHSA-794x-8x6x-qpfc`, `CVE-2025-53602` · Maven `io.zipkin:zipkin-server`: affected `<=3.5.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2025 · Tags: CWE-1188
- [junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener](https://agentprime.io/advisories/GHSA-m43g-m425-p68x.md)
  `GHSA-m43g-m425-p68x`, `CVE-2025-53103` · Maven `org.junit.platform:junit-platform-reporting`: affected `>=5.12.0, <5.13.2`, fixed in `5.13.2` · CVSS 5.8 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Information disclosure
- [Graylog vulnerable to privilege escalation through API tokens](https://agentprime.io/advisories/GHSA-3m86-c9x3-vwm9.md)
  `GHSA-3m86-c9x3-vwm9`, `CVE-2025-53106` · Maven `org.graylog2:graylog2-server`: affected `>=6.2.0, <6.2.4 || >=6.3.0-alpha.1, <6.3.0-rc.2`, fixed in `6.2.4`, `6.3.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2025 · Tags: Broken access control
- [Conductor vulnerable to OS command injection through unrestricted access to Java classes](https://agentprime.io/advisories/GHSA-8gqp-hr9g-pg62.md)
  `GHSA-8gqp-hr9g-pg62`, `CVE-2025-26074` · Maven `org.conductoross:conductor-core`: affected `<3.21.13`, fixed in `3.21.13` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2025 · Tags: Command injection
- [Janssen Config API returns results without scope verification](https://agentprime.io/advisories/GHSA-373j-mhpf-84wg.md)
  `GHSA-373j-mhpf-84wg`, `CVE-2025-53003` · Maven `io.jans:jans-config-api-server`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 8.2 High · Not analysed yet · Published 30 Jun 2025 · Tags: Information disclosure, Privilege escalation, Broken access control
- [akka-cluster-metrics uses Java serialization for cluster metrics](https://agentprime.io/advisories/GHSA-358m-fq53-hp87.md)
  `GHSA-358m-fq53-hp87`, `CVE-2025-53393` · Maven `com.typesafe.akka:akka-cluster-metrics_2.13` and 1 more: affected `<=2.10.6`, no fixed version yet · CVSS 6.0 Medium · Not analysed yet · Published 29 Jun 2025 · Tags: Insecure deserialization
- [Apache Seata Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-m964-fjrh-xxq2.md)
  `GHSA-m964-fjrh-xxq2`, `CVE-2025-32897` · Maven `org.apache.seata:seata-config-core`: affected `>=2.0.0, <2.3.0`, fixed in `2.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jun 2025 · Tags: Insecure deserialization
- [jackson-core can throw a StackoverflowError when processing deeply nested data](https://agentprime.io/advisories/GHSA-h46c-h94j-95f3.md)
  `GHSA-h46c-h94j-95f3`, `CVE-2025-52999` · Maven `com.fasterxml.jackson.core:jackson-core`: affected `<2.15.0`, fixed in `2.15.0` · CVSS 8.7 High · Not analysed yet · Published 27 Jun 2025 · Tags: Memory corruption
- [Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information](https://agentprime.io/advisories/GHSA-cqm8-rg2p-jfcf.md)
  `GHSA-cqm8-rg2p-jfcf`, `CVE-2025-5731` · Maven `org.infinispan:infinispan-cli-client`: affected `<=16.0.0.Dev01`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 27 Jun 2025 · Tags: Information disclosure
- [XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument](https://agentprime.io/advisories/GHSA-r26v-98qj-48q9.md)
  `GHSA-r26v-98qj-48q9`, `CVE-2025-6701` · Maven `com.xuxueli:xxl-sso`: affected `<=1.1.0`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: Open redirect
- [Xuxueli XXL-SSO Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-2jfg-73q2-24qv.md)
  `GHSA-2jfg-73q2-24qv`, `CVE-2025-6700` · Maven `com.xuxueli:xxl-sso`: affected `<=1.1.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Allure Report allows Improper XXE Restriction via DocumentBuilderFactory](https://agentprime.io/advisories/GHSA-h7qf-qmf3-85qg.md)
  `GHSA-h7qf-qmf3-85qg`, `CVE-2025-52888` · Maven `io.qameta.allure.plugins:junit-xml-plugin` and 2 more: affected `<2.34.1`, fixed in `2.34.1` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2025 · Tags: XML external entities (XXE)
- [Quarkus potentially leaks data when duplicating a duplicated context](https://agentprime.io/advisories/GHSA-9623-mj7j-p9v4.md)
  `GHSA-9623-mj7j-p9v4`, `CVE-2025-49574` · Maven `io.quarkus:quarkus-vertx`: affected `<3.15.6 || >=3.16.0.CR1, <3.20.2 || >=3.21.0.CR1, <3.24.1`, fixed in `3.15.6`, `3.20.2`, `3.24.1` · CVSS 6.4 Medium · Not analysed yet · Published 23 Jun 2025 · Tags: Information disclosure
- [sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+](https://agentprime.io/advisories/GHSA-7cjh-xx4r-qh3f.md)
  `GHSA-7cjh-xx4r-qh3f` · Maven `io.sentry:sentry-android` and 1 more: affected `<8.14.0`, fixed in `8.14.0` · CVSS 4.0, no score published · Not analysed yet · Published 20 Jun 2025 · Tags: Information disclosure
- [Crafter Studio Groovy Sandbox Bypass](https://agentprime.io/advisories/GHSA-5644-3vgq-2ph5.md)
  `GHSA-5644-3vgq-2ph5`, `CVE-2025-6384` · Maven `org.craftercms:crafter-studio`: affected `>=4.0.0, <4.3.0`, fixed in `4.3.0` · CVSS 7.3 High · Not analysed yet · Published 19 Jun 2025 · Tags: CWE-913
- [PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion](https://agentprime.io/advisories/GHSA-8qjw-9xgm-c9ff.md)
  `GHSA-8qjw-9xgm-c9ff`, `CVE-2025-48059` · Maven `com.powsybl:powsybl-contingency-api` and 1 more: affected `>=5.0.0, <6.3.0`, fixed in `6.3.0` · CVSS 2.7 Low · Not analysed yet · Published 19 Jun 2025 · Tags: Denial of service
- [PowSyBl Core contains Polynomial REDoS’es](https://agentprime.io/advisories/GHSA-rqpx-f6rc-7hm5.md)
  `GHSA-rqpx-f6rc-7hm5`, `CVE-2025-48058` · Maven `com.powsybl:powsybl-commons`: affected `<6.7.2`, fixed in `6.7.2` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Denial of service
- [PowSyBl Core allows deserialization of untrusted SparseMatrix data](https://agentprime.io/advisories/GHSA-f5cx-h789-j959.md)
  `GHSA-f5cx-h789-j959`, `CVE-2025-47771` · Maven `com.powsybl:powsybl-math`: affected `>=6.3.0, <6.7.2`, fixed in `6.7.2` · CVSS 8.1 High · Not analysed yet · Published 19 Jun 2025 · Tags: Insecure deserialization
- [PowSyBl Core XML Reader allows XXE and SSRF](https://agentprime.io/advisories/GHSA-qpj9-qcwx-8jv2.md)
  `GHSA-qpj9-qcwx-8jv2`, `CVE-2025-47293` · Maven `com.powsybl:powsybl-commons`: affected `<6.7.2`, fixed in `6.7.2` · CVSS 2.7 Low · Not analysed yet · Published 19 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [Apache SeaTunnel: Unauthenticated insecure access](https://agentprime.io/advisories/GHSA-9x53-gr7p-4qf5.md)
  `GHSA-9x53-gr7p-4qf5`, `CVE-2025-32896` · Maven `org.apache.seatunnel:seatunnel-engine-common` and 1 more: affected `<2.3.11`, fixed in `2.3.11` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Authentication bypass
- [Apache Tomcat - Security constraint bypass for pre/post-resources](https://agentprime.io/advisories/GHSA-wc4r-xq3c-5cf3.md)
  `GHSA-wc4r-xq3c-5cf3`, `BIT-tomcat-2025-49125`, `CVE-2025-49125` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106 || >=8.5.0, <=8.5.100`, fixed in `11.0.8`, `10.1.42`, `9.0.106` · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2025 · Tags: Authentication bypass
- [Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers](https://agentprime.io/advisories/GHSA-vv7r-c36w-3prj.md)
  `GHSA-vv7r-c36w-3prj`, `CVE-2025-48976` · Maven `commons-fileupload:commons-fileupload` and 1 more: affected `>=1.0, <1.6.0`, fixed in `1.6.0` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.34 · Not analysed yet · Published 16 Jun 2025 · Tags: Denial of service
- [Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler](https://agentprime.io/advisories/GHSA-p73j-gpcq-49h8.md)
  `GHSA-p73j-gpcq-49h8`, `CVE-2025-3594` · Maven `com.liferay:com.liferay.server.admin.web`: affected `>=5.0.0, <5.0.24 || >=4.0.0, <4.0.48 || >=3.0.0, <3.0.67 || >=2.0.0, <2.0.66 || <1.0.93`, fixed in `5.0.24`, `4.0.48`, `3.0.67`, `2.0.66`, `1.0.93` · CVSS 8.6 High · Not analysed yet · Published 16 Jun 2025 · Tags: Path traversal
- [Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session](https://agentprime.io/advisories/GHSA-mf3r-6m25-3867.md)
  `GHSA-mf3r-6m25-3867`, `CVE-2025-3526` · Maven `com.liferay.portal:com.liferay.portal.kernel`: affected `<38.0.0`, fixed in `38.0.0` · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2025 · Tags: Denial of service
- [Apache Tomcat - DoS in multipart upload](https://agentprime.io/advisories/GHSA-h3gc-qfqq-6h8f.md)
  `GHSA-h3gc-qfqq-6h8f`, `BIT-tomcat-2025-48988`, `CVE-2025-48988` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106 || >=8.5.0, <=8.5.100`, fixed in `11.0.8`, `10.1.42`, `9.0.106` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 16 Jun 2025 · Tags: Denial of service
- [Apache Tomcat installer for Windows has an untrusted search path vulnerability](https://agentprime.io/advisories/GHSA-42wg-hm62-jcwg.md)
  `GHSA-42wg-hm62-jcwg`, `BIT-tomcat-2025-49124`, `CVE-2025-49124` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.8 || >=10.1.0, <10.1.42 || >=9.0.23, <9.0.106`, fixed in `11.0.8`, `10.1.42`, `9.0.106` · CVSS 8.4 High · Not analysed yet · Published 16 Jun 2025 · Tags: CWE-426

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA2LTE2VDE1OjMyOjI4LjAwMDAwMFoiLCJHSFNBLTQyd2ctaG02Mi1qY3dnIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA3LTEwVDIxOjMxOjUzLjAwMDAwMFoiLCJHSFNBLTI1eHItcWo4dy1jNHZmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA3LTEwVDIxOjMxOjUzLjAwMDAwMFoiLCJHSFNBLTI1eHItcWo4dy1jNHZmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.