# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [Netty affected by MadeYouReset HTTP/2 DDoS vulnerability](https://agentprime.io/advisories/GHSA-prj3-ccx8-p6x4.md) `GHSA-prj3-ccx8-p6x4`, `CVE-2025-55163` · Maven `io.grpc:grpc-netty-shaded` and 1 more: affected `<1.75.0`, fixed in `1.75.0` · CVSS 8.2 High · Not analysed yet · Published 13 Aug 2025 · Tags: Denial of service - [Apache Tomcat Improper Resource Shutdown or Release vulnerability](https://agentprime.io/advisories/GHSA-gqp3-2cvr-x8m3.md) `GHSA-gqp3-2cvr-x8m3`, `BIT-tomcat-2025-48989`, `CVE-2025-48989` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.10 || >=10.1.0-M1, <10.1.44 || >=9.0.0.M1, <9.0.108`, fixed in `11.0.10`, `10.1.44`, `9.0.108` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2025 · Tags: Denial of service - [Apache Tomcat Session Fixation vulnerability](https://agentprime.io/advisories/GHSA-23hv-mwm6-g8jf.md) `GHSA-23hv-mwm6-g8jf`, `BIT-tomcat-2025-55668`, `CVE-2025-55668` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106`, fixed in `11.0.8`, `10.1.42`, `9.0.106` · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Authentication bypass - [Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation](https://agentprime.io/advisories/GHSA-4cx2-fc23-5wg6.md) `GHSA-4cx2-fc23-5wg6`, `CVE-2025-8916` · Maven `org.bouncycastle:bcpkix-fips` and 3 more: affected `>=1.0.0, <1.0.8 || >=2.0.0, <2.0.8`, fixed in `1.0.8`, `2.0.8` · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Denial of service - [Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-m5c7-5gv3-hcpf.md) `GHSA-m5c7-5gv3-hcpf`, `CVE-2025-43734` · Maven `com.liferay:com.liferay.frontend.taglib.clay` and 2 more: affected `<15.2.2`, fixed in `15.2.2` · CVSS 5.1 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Cross-site scripting (XSS) - [Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability](https://agentprime.io/advisories/GHSA-222w-xmc5-jhp3.md) `GHSA-222w-xmc5-jhp3`, `CVE-2025-43735` · Maven `com.liferay.portal:com.liferay.portal.impl` and 2 more: affected `>=7.0.4, <109.1.0`, fixed in `109.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Cross-site scripting (XSS) - [Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability](https://agentprime.io/advisories/GHSA-cg99-m88x-422c.md) `GHSA-cg99-m88x-422c`, `CVE-2025-43736` · Maven `com.liferay:com.liferay.account.admin.web` and 5 more: affected `<2.0.138`, fixed in `2.0.138` · CVSS 6.9 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Denial of service - [Bouncy Castle for Java on All (API modules) allows Excessive Allocation](https://agentprime.io/advisories/GHSA-67mf-3cr5-8w23.md) `GHSA-67mf-3cr5-8w23`, `CVE-2025-8885` · Maven `org.bouncycastle:bc-fips` and 6 more: affected `>=1.0.0, <1.0.2.6 || >=2.0.0, <2.0.1`, fixed in `1.0.2.6`, `2.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Denial of service - [Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-c6g5-g6r7-q4j6.md) `GHSA-c6g5-g6r7-q4j6`, `CVE-2025-4655` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2025.Q1.0, <2025.Q1.6 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92`, fixed in `2025.Q1.6`, `2024.Q1.16` · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-6v93-frf9-2rp8.md) `GHSA-6v93-frf9-2rp8`, `CVE-2025-4581` · Maven `com.liferay.portal:release.dxp.bom` and 1 more: affected `>=2025.Q1.0, <2025.Q1.5 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92`, fixed in `2025.Q1.5`, `2024.Q1.16` · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Server-side request forgery (SSRF) - [Liferay Portal Reflected XSS in blogs-web](https://agentprime.io/advisories/GHSA-6qcg-28jh-hm7r.md) `GHSA-6qcg-28jh-hm7r`, `CVE-2025-4576` · Maven `com.liferay:com.liferay.blogs.web`: affected `<6.0.139`, fixed in `6.0.139` · CVSS 6.9 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Cross-site scripting (XSS) - [Apache CXF: Untrusted JMS configuration can lead to RCE](https://agentprime.io/advisories/GHSA-g4px-6qhm-hqjm.md) `GHSA-g4px-6qhm-hqjm`, `CVE-2025-48913` · Maven `org.apache.cxf:cxf-rt-transports-jms`: affected `<3.6.8 || >=4.0.0, <4.0.9 || >=4.1.0, <4.1.3`, fixed in `3.6.8`, `4.0.9`, `4.1.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: CWE-20 - [Apache Seata: Deserialization of untrusted Data in Apache Seata Server](https://agentprime.io/advisories/GHSA-g358-g2pq-c46j.md) `GHSA-g358-g2pq-c46j`, `CVE-2025-53606` · Maven `org.apache.seata:seata-serializer-fury`: affected `>=2.4.0, <2.5.0`, fixed in `2.5.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Insecure deserialization - [ExecuTorch vulnerable to Heap-based Buffer Overflow](https://agentprime.io/advisories/GHSA-xc7w-r669-48pf.md) `GHSA-xc7w-r669-48pf`, `CVE-2025-54951`, `PYSEC-2026-336` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0`, fixed in `0.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Memory corruption - [ExecuTorch integer overflow vulnerability](https://agentprime.io/advisories/GHSA-hj95-mhgf-jxc4.md) `GHSA-hj95-mhgf-jxc4`, `CVE-2025-30404`, `PYSEC-2026-335` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0`, fixed in `0.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Memory corruption - [ExecuTorch out-of-bounds access vulnerability](https://agentprime.io/advisories/GHSA-f9hx-c6jf-3qxm.md) `GHSA-f9hx-c6jf-3qxm`, `CVE-2025-54950`, `PYSEC-2026-334` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0`, fixed in `0.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Memory corruption - [ExecuTorch heap buffer overflow vulnerability](https://agentprime.io/advisories/GHSA-9m39-3mf3-xwch.md) `GHSA-9m39-3mf3-xwch`, `CVE-2025-54949`, `PYSEC-2026-333` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0`, fixed in `0.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Memory corruption - [ExecuTorch integer overflow vulnerability](https://agentprime.io/advisories/GHSA-84m3-f99p-cqx5.md) `GHSA-84m3-f99p-cqx5`, `CVE-2025-30405`, `PYSEC-2026-332` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0`, fixed in `0.7.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Memory corruption - [Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability](https://agentprime.io/advisories/GHSA-qj5r-2r5p-phc7.md) `GHSA-qj5r-2r5p-phc7` · Maven `org.keycloak:keycloak-services`: affected `<=26.3.2`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 6 Aug 2025 · Tags: Other injection - [XWiki exposes passwords and emails stored in fields not named password/email in xml.vm](https://agentprime.io/advisories/GHSA-57q2-6cp4-9mq3.md) `GHSA-57q2-6cp4-9mq3`, `CVE-2025-54125` · Maven `org.xwiki.platform:xwiki-platform-legacy-oldcore` and 1 more: affected `>=1.1, <16.4.7 || >=16.5.0-rc-1, <16.10.5 || >=17.0.0-rc-1, <17.2.0-rc-1`, fixed in `16.4.7`, `16.10.5`, `17.2.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 5 Aug 2025 · Tags: Information disclosure - [XWiki leaks password hashes and other accessible password properties](https://agentprime.io/advisories/GHSA-r38m-cgpg-qj69.md) `GHSA-r38m-cgpg-qj69`, `CVE-2025-54124` · Maven `org.xwiki.platform:xwiki-platform-legacy-oldcore` and 1 more: affected `>=9.8-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.5 || >=17.0.0-rc-1, <17.2.0-rc-1`, fixed in `16.4.7`, `16.10.5`, `17.2.0-rc-1` · CVSS 7.1 High · Not analysed yet · Published 5 Aug 2025 · Tags: Information disclosure - [XWiki allows Reflected XSS in two templates](https://agentprime.io/advisories/GHSA-m9x4-w7p9-mxhx.md) `GHSA-m9x4-w7p9-mxhx`, `CVE-2025-32430` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `>=4.2-milestone-3, <16.4.8 || >=16.5.0-rc-1, <16.10.6 || >=17.0.0-rc-1, <17.3.0-rc-1`, fixed in `16.4.8`, `16.10.6`, `17.3.0-rc-1` · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS) - [Liferay Portal CAPTCHA Bypass for Gogo Shell](https://agentprime.io/advisories/GHSA-3j6h-5v68-hvqg.md) `GHSA-3j6h-5v68-hvqg`, `CVE-2025-4604` · Maven `com.liferay:com.liferay.captcha.impl`: affected `<4.0.17`, fixed in `4.0.17` · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS) - [Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability](https://agentprime.io/advisories/GHSA-xg8j-j6vp-6h5w.md) `GHSA-xg8j-j6vp-6h5w`, `CVE-2024-51775` · Maven `org.apache.zeppelin:zeppelin-shell`: affected `>=0.11.1, <0.12.0`, fixed in `0.12.0` · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2025 · Tags: CWE-1385 - [Apache Zeppelin: XSS in the Helium module](https://agentprime.io/advisories/GHSA-p288-459w-jxj6.md) `GHSA-p288-459w-jxj6`, `CVE-2024-41177` · Maven `org.apache.zeppelin:zeppelin-web`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 6.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS) - [Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string](https://agentprime.io/advisories/GHSA-jr43-q92q-5q82.md) `GHSA-jr43-q92q-5q82`, `CVE-2024-52279` · Maven `org.apache.zeppelin:zeppelin-jdbc`: affected `>=0.11.1, <0.12.0`, fixed in `0.12.0` · CVSS 7.5 High · Not analysed yet · Published 3 Aug 2025 · Tags: CWE-20 - [OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object](https://agentprime.io/advisories/GHSA-2rjv-cv85-xhgm.md) `GHSA-2rjv-cv85-xhgm` · Maven `org.opensearch.plugin:opensearch-security`: affected `<2.19.3.0`, fixed in `2.19.3.0` · CVSS 5.7 Medium · Not analysed yet · Published 1 Aug 2025 · Tags: Information disclosure - [OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape](https://agentprime.io/advisories/GHSA-rrmm-wq7q-h4v5.md) `GHSA-rrmm-wq7q-h4v5` · Maven `org.opensearch.plugin:opensearch-security`: affected `<2.19.3.0`, fixed in `2.19.3.0` · CVSS 5.7 Medium · Not analysed yet · Published 1 Aug 2025 · Tags: Information disclosure - [Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering](https://agentprime.io/advisories/GHSA-rrff-chj9-w4c7.md) `GHSA-rrff-chj9-w4c7`, `CVE-2025-24853` · Maven `org.apache.jspwiki:jspwiki-main` and 1 more: affected `<2.12.3`, fixed in `2.12.3` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS) - [Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin](https://agentprime.io/advisories/GHSA-72ww-4rcw-mc62.md) `GHSA-72ww-4rcw-mc62`, `CVE-2025-24854` · Maven `org.apache.jspwiki:jspwiki-main`: affected `<2.12.3`, fixed in `2.12.3` · CVSS 6.1 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS) - [Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability](https://agentprime.io/advisories/GHSA-cx25-xg7c-xfm5.md) `GHSA-cx25-xg7c-xfm5`, `CVE-2025-54656` · Maven `org.apache.struts:struts-extras` and 1 more: affected `<=1.3.10`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Other injection - [Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)](https://agentprime.io/advisories/GHSA-27gp-8389-hm4w.md) `GHSA-27gp-8389-hm4w`, `CVE-2025-7784` · Maven `org.keycloak:keycloak-services`: affected `>=26.2.0, <26.2.6`, fixed in `26.2.6` · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Privilege escalation - [Keycloak phishing attack via email verification step in first login flow](https://agentprime.io/advisories/GHSA-xhpr-465j-7p9q.md) `GHSA-xhpr-465j-7p9q`, `CVE-2025-7365` · Maven `org.keycloak:keycloak-services`: affected `<26.0.13 || >=26.2.0, <26.2.6`, fixed in `26.0.13`, `26.2.6` · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2025 · Tags: CWE-346 - [Opencast still publishes global system account credentials](https://agentprime.io/advisories/GHSA-j63h-hmgw-x4j7.md) `GHSA-j63h-hmgw-x4j7`, `CVE-2025-54380` · Maven `org.opencastproject:opencast-common` and 3 more: affected `<17.6`, fixed in `17.6` · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: Information disclosure, Hard-coded credentials - [XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API](https://agentprime.io/advisories/GHSA-p9qm-p942-q3w5.md) `GHSA-p9qm-p942-q3w5`, `CVE-2025-54385` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `>=1.0, <16.10.6 || >=17.0.0-rc1, <17.3.0-rc-1`, fixed in `16.10.6`, `17.3.0-rc-1` · CVSS 8.6 High · Not analysed yet · Published 25 Jul 2025 · Tags: SQL injection, CWE-20 - [XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter](https://agentprime.io/advisories/GHSA-vr59-gm53-v7cq.md) `GHSA-vr59-gm53-v7cq`, `CVE-2025-32429` · Maven `org.xwiki.platform:xwiki-platform-distribution-war`: affected `>=9.4-rc-1, <16.10.6 || >=17.0.0-rc-1, <17.3.0-rc-1`, fixed in `16.10.6`, `17.3.0-rc-1` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.85 · Not analysed yet · Published 24 Jul 2025 · Tags: SQL injection - [Jakarta Mail vulnerable to SMTP Injection](https://agentprime.io/advisories/GHSA-9342-92gg-6v29.md) `GHSA-9342-92gg-6v29`, `CVE-2025-7962` · Maven `com.sun.mail:jakarta.mail` and 1 more: affected `<1.6.8 || >=2.0.0, <2.0.2`, fixed in `1.6.8`, `2.0.2` · CVSS 6.0 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-147 - [Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access](https://agentprime.io/advisories/GHSA-xg9p-p463-3qjp.md) `GHSA-xg9p-p463-3qjp`, `CVE-2025-50151` · Maven `org.apache.jena:jena`: affected `<5.5.0`, fixed in `5.5.0` · CVSS 7.2 High · Not analysed yet · Published 21 Jul 2025 · Tags: CWE-20 - [Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server](https://agentprime.io/advisories/GHSA-jq2c-m8gg-mqcm.md) `GHSA-jq2c-m8gg-mqcm`, `CVE-2025-49656` · Maven `org.apache.jena:jena-fuseki`: affected `<5.5.0`, fixed in `5.5.0` · CVSS 4.9 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Path traversal - [xxl-job has Inadequate Encryption Strength](https://agentprime.io/advisories/GHSA-565h-44m8-4c2v.md) `GHSA-565h-44m8-4c2v`, `CVE-2025-7789` · Maven `com.xuxueli:xxl-job-admin`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Weak cryptography or TLS - [XXL-JOB is vulnerable to SSRF attacks](https://agentprime.io/advisories/GHSA-f8vw-8vgh-22r9.md) `GHSA-f8vw-8vgh-22r9`, `CVE-2025-7787` · Maven `com.xuxueli:xxl-job-core`: affected `<=3.1.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)](https://agentprime.io/advisories/GHSA-83j7-mhw9-388w.md) `GHSA-83j7-mhw9-388w` · Maven `org.keycloak:keycloak-services`: affected `<=26.3.1`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 18 Jul 2025 · Tags: Privilege escalation - [Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints](https://agentprime.io/advisories/GHSA-f7h5-c625-3795.md) `GHSA-f7h5-c625-3795`, `CVE-2024-9408` · Maven `org.glassfish.main.admingui:console-common`: affected `<=6.2.5`, no fixed version yet · CVSS 8.9 High · Not analysed yet · Published 16 Jul 2025 · Tags: Server-side request forgery (SSRF) - [Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console](https://agentprime.io/advisories/GHSA-vqrm-83g6-pfv4.md) `GHSA-vqrm-83g6-pfv4`, `CVE-2024-10029` · Maven `org.glassfish.main.admingui:console-cluster-plugin` and 1 more: affected `<=7.0.25`, no fixed version yet · CVSS 4.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS) - [Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console](https://agentprime.io/advisories/GHSA-mqxx-c43h-jj9v.md) `GHSA-mqxx-c43h-jj9v`, `CVE-2024-9343` · Maven `org.glassfish.main.admingui:console-common`: affected `<=7.0.25`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS) - [Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications](https://agentprime.io/advisories/GHSA-hp97-5x6g-q538.md) `GHSA-hp97-5x6g-q538`, `CVE-2024-10031` · Maven `org.glassfish.main.admingui:console-common`: affected `<=7.0.25`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS) - [Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts](https://agentprime.io/advisories/GHSA-99f7-hp6j-v6q4.md) `GHSA-99f7-hp6j-v6q4`, `CVE-2024-9342` · Maven `org.glassfish.main.admingui:console-common`: affected `<=7.0.25`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Authentication bypass - [Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console](https://agentprime.io/advisories/GHSA-62g9-99m7-w8wv.md) `GHSA-62g9-99m7-w8wv`, `CVE-2024-10032` · Maven `org.glassfish.main.admingui:console-cluster-plugin`: affected `<=7.0.25`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS) - [Reactor Netty HTTP is vulnerable to credential leaks during chained redirects](https://agentprime.io/advisories/GHSA-4q2v-9p7v-3v22.md) `GHSA-4q2v-9p7v-3v22`, `CVE-2025-22227` · Maven `io.projectreactor.netty:reactor-netty-http`: affected `>=1.3.0-M1, <1.3.0-M5 || <1.2.8`, fixed in `1.3.0-M5`, `1.2.8` · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Information disclosure - [DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format](https://agentprime.io/advisories/GHSA-vhvx-8xgc-99wf.md) `GHSA-vhvx-8xgc-99wf`, `CVE-2025-53622` · Maven `org.dspace:dspace-api`: affected `<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1`, fixed in `7.6.4`, `8.2`, `9.1` · CVSS 5.2 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Path traversal - [DSpace is vulnerable to XML External Entity injection during archive imports](https://agentprime.io/advisories/GHSA-jjwr-5cfh-7xwh.md) `GHSA-jjwr-5cfh-7xwh`, `CVE-2025-53621` · Maven `org.dspace:dspace-api`: affected `<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1`, fixed in `7.6.4`, `8.2`, `9.1` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: XML external entities (XXE) - [Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged](https://agentprime.io/advisories/GHSA-36wv-v2qp-v4g4.md) `GHSA-36wv-v2qp-v4g4`, `CVE-2025-48795` · Maven `org.apache.cxf:cxf-core`: affected `<3.5.11 || >=3.6.0, <3.6.6 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.1`, fixed in `3.5.11`, `3.6.6`, `4.0.7`, `4.1.1` · CVSS 5.6 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Denial of service - [XWiki Rendering is vulnerable to RCE attacks when processing nested macros](https://agentprime.io/advisories/GHSA-32mf-57h2-64x9.md) `GHSA-32mf-57h2-64x9`, `CVE-2025-53836` · Maven `org.xwiki.rendering:xwiki-rendering-transformation-macro`: affected `>=4.2-milestone-1, <13.10.11 || >=14.0, <14.4.7 || >=14.5, <14.10`, fixed in `13.10.11`, `14.4.7`, `14.10` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2025 · Tags: Code injection, Broken access control - [XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax](https://agentprime.io/advisories/GHSA-w3wh-g4m9-783p.md) `GHSA-w3wh-g4m9-783p`, `CVE-2025-53835` · Maven `org.xwiki.rendering:xwiki-rendering-syntax-xhtml`: affected `>=5.4.5, <14.10`, fixed in `14.10` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2025 · Tags: Cross-site scripting (XSS) - [Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build](https://agentprime.io/advisories/GHSA-44c3-38h8-9fh9.md) `GHSA-44c3-38h8-9fh9`, `CVE-2025-53689` · Maven `org.apache.jackrabbit:jackrabbit-core` and 1 more: affected `>=2.23.0-beta, <2.23.2-beta || >=2.20.0, <2.20.17 || >=2.22.0, <2.22.1`, fixed in `2.23.2-beta`, `2.20.17`, `2.22.1` · CVSS 8.8 High · Not analysed yet · Published 14 Jul 2025 · Tags: XML external entities (XXE) - [Apache Zeppelin exposes server resources to unauthenticated attackers](https://agentprime.io/advisories/GHSA-7pgf-ppxw-8624.md) `GHSA-7pgf-ppxw-8624`, `CVE-2024-41169` · Maven `org.apache.zeppelin:zeppelin-interpreter` and 1 more: affected `>=0.10.1, <0.12.0`, fixed in `0.12.0` · CVSS 7.5 High · Not analysed yet · Published 12 Jul 2025 · Tags: CWE-664 - [ExecuTorch vulnerable to Heap-based Buffer Overflow attack](https://agentprime.io/advisories/GHSA-h952-963h-rv99.md) `GHSA-h952-963h-rv99`, `CVE-2025-30402`, `PYSEC-2026-1352` · Maven `org.pytorch:executorch-android` and 1 more: affected `<0.7.0-rc1`, fixed in `0.7.0-rc1` · CVSS 8.1 High · Not analysed yet · Published 11 Jul 2025 · Tags: Memory corruption - [Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs](https://agentprime.io/advisories/GHSA-j288-q9x7-2f5v.md) `GHSA-j288-q9x7-2f5v`, `CVE-2025-48924` · Maven `commons-lang:commons-lang` and 1 more: affected `>=2.0, <=2.6`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: Denial of service - [Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON](https://agentprime.io/advisories/GHSA-xwmg-2g98-w7v9.md) `GHSA-xwmg-2g98-w7v9`, `CVE-2025-53864` · Maven `com.nimbusds:nimbus-jose-jwt`: affected `>=9.38-rc1, <10.0.2 || <9.37.4`, fixed in `10.0.2`, `9.37.4` · CVSS 5.8 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: Denial of service - [Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams](https://agentprime.io/advisories/GHSA-25xr-qj8w-c4vf.md) `GHSA-25xr-qj8w-c4vf`, `BIT-tomcat-2025-53506`, `CVE-2025-53506` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=8.5.0, <=8.5.100 || >=9.0.0.M1, <9.0.107 || >=10.1.0-M1, <10.1.43 || >=11.0.0-M1, <11.0.9`, fixed in `9.0.107`, `10.1.43`, `11.0.9` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2025 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .