# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [XWiki configuration files can be accessed through the webjars API](https://agentprime.io/advisories/GHSA-qww7-89xh-x7m7.md)
  `GHSA-qww7-89xh-x7m7`, `CVE-2025-55747` · Maven `org.xwiki.platform:xwiki-platform-webjars` and 1 more: affected `>=6.1-miletone-2, <=7.1.3`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2025 · Tags: Path traversal
- [Jenkins global-build-stats Plugin missing permission check can result in graph IDs being enumerated](https://agentprime.io/advisories/GHSA-gm8g-fh49-qq6v.md)
  `GHSA-gm8g-fh49-qq6v`, `CVE-2025-58459` · Maven `org.jenkins-ci.plugins:global-build-stats`: affected `<347.v32a`, fixed in `347.v32a` · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Broken access control
- [Jenkins Git client Plugin file system information disclosure vulnerability](https://agentprime.io/advisories/GHSA-g2pq-9jr7-w6gv.md)
  `GHSA-g2pq-9jr7-w6gv`, `CVE-2025-58458` · Maven `org.jenkins-ci.plugins:git-client`: affected `<6.3.3`, fixed in `6.3.3` · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Information disclosure
- [Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials](https://agentprime.io/advisories/GHSA-f696-867g-2759.md)
  `GHSA-f696-867g-2759`, `CVE-2025-58460` · Maven `io.jenkins.plugins:opentelemetry`: affected `<3.1543.1545.vf5a`, fixed in `3.1543.1545.vf5a` · CVSS 4.2 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Broken access control
- [Apache DolphinScheduler Incorrect Default Permissions Vulnerability](https://agentprime.io/advisories/GHSA-rrpj-r8h7-rm7r.md)
  `GHSA-rrpj-r8h7-rm7r`, `CVE-2024-43166` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.3.1`, fixed in `3.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2025 · Tags: Broken access control
- [Silverpeas Core Username Enumeration Vulnerability](https://agentprime.io/advisories/GHSA-cv2m-5pfp-f245.md)
  `GHSA-cv2m-5pfp-f245`, `CVE-2025-46047` · Maven `org.silverpeas.core:silverpeas-core`: affected `>=6.4.1, <6.4.3`, fixed in `6.4.3` · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2025 · Tags: CWE-20, CWE-204
- [Undertow MadeYouReset HTTP/2 DDoS Vulnerability](https://agentprime.io/advisories/GHSA-95h4-w6j8-2rp8.md)
  `GHSA-95h4-w6j8-2rp8`, `CVE-2025-9784` · Maven `io.undertow:undertow-core`: affected `<2.2.38.Final || >=2.3.0.Alpha1, <2.3.20.Final`, fixed in `2.2.38.Final`, `2.3.20.Final` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2025 · Tags: Denial of service
- [Liferay Portal allows improper access through the expandoTableLocalService](https://agentprime.io/advisories/GHSA-876g-49r6-33qj.md)
  `GHSA-876g-49r6-33qj`, `CVE-2025-43773` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.runtime.impl`: affected `<6.0.93`, fixed in `6.0.93` · CVSS 4.6 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Broken access control
- [Opencast has a partial path traversal vulnerability in UI config](https://agentprime.io/advisories/GHSA-hq8m-v68g-8cf8.md)
  `GHSA-hq8m-v68g-8cf8`, `CVE-2025-55202` · Maven `org.opencastproject:opencast-user-interface-configuration`: affected `<17.7 || >=18.0, <18.1`, fixed in `17.7`, `18.1` · CVSS 2.7 Low · Not analysed yet · Published 29 Aug 2025 · Tags: Path traversal
- [Valtimo scripting engine can be used to gain access to sensitive data or resources](https://agentprime.io/advisories/GHSA-w48j-pp7j-fj55.md)
  `GHSA-w48j-pp7j-fj55`, `CVE-2025-58059` · Maven `com.ritense.valtimo:core`: affected `<12.16.0.RELEASE || >=13.0.0.RELEASE, <13.1.2.RELEASE`, fixed in `12.16.0.RELEASE`, `13.1.2.RELEASE` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2025 · Tags: Command injection, Information disclosure
- [XWiki PDF export jobs store sensitive cookies unencrypted in job statuses](https://agentprime.io/advisories/GHSA-9m7c-m33f-3429.md)
  `GHSA-9m7c-m33f-3429`, `CVE-2025-58049` · Maven `org.xwiki.platform:xwiki-platform-export-pdf-api`: affected `>=14.4.2, <16.4.8 || >=16.5.0-rc-1, <16.10.7 || >=17.0.0-rc-1, <17.4.0-rc-1`, fixed in `16.4.8`, `16.10.7`, `17.4.0-rc-1` · CVSS 5.8 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-212, CWE-257
- [Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)](https://agentprime.io/advisories/GHSA-5c4f-pxmx-xcm4.md)
  `GHSA-5c4f-pxmx-xcm4`, `BIT-cassandra-2025-26467`, `CVE-2025-26467` · Maven `org.apache.cassandra:cassandra-all`: affected `>=4.0.16, <4.0.17`, fixed in `4.0.17` · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2025 · Tags: Privilege escalation
- [Liferay Portal allows unrestricted upload of file in the style books component](https://agentprime.io/advisories/GHSA-mf9q-87xx-jgvv.md)
  `GHSA-mf9q-87xx-jgvv`, `CVE-2025-43766` · Maven `com.liferay:com.liferay.style.book.web`: affected `<2.0.117`, fixed in `2.0.117` · CVSS 6.8 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Unrestricted file upload
- [Liferay Portal stored cross-site scripting in text field of the web content structure](https://agentprime.io/advisories/GHSA-h8gx-4hhm-w45v.md)
  `GHSA-h8gx-4hhm-w45v`, `CVE-2025-43765` · Maven `com.liferay:com.liferay.journal.service`: affected `<7.0.161`, fixed in `7.0.161` · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect](https://agentprime.io/advisories/GHSA-6hj4-v2qp-cqr2.md)
  `GHSA-6hj4-v2qp-cqr2`, `CVE-2025-43767` · Maven `com.liferay:com.liferay.info.impl`: affected `<5.0.69`, fixed in `5.0.69` · CVSS 5.1 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Open redirect
- [Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet](https://agentprime.io/advisories/GHSA-23w4-rpc6-wpcc.md)
  `GHSA-23w4-rpc6-wpcc`, `CVE-2025-43764` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.designer.web`: affected `<5.0.145`, fixed in `5.0.145` · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Denial of service
- [Liferay Portal vulnerable to Stored XSS in Components portlet](https://agentprime.io/advisories/GHSA-rvmf-jw8g-r35r.md)
  `GHSA-rvmf-jw8g-r35r`, `CVE-2025-43769` · Maven `com.liferay:com.liferay.plugins.admin.web`: affected `<5.0.36`, fixed in `5.0.36` · CVSS 4.6 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter](https://agentprime.io/advisories/GHSA-h4m4-xp33-37mj.md)
  `GHSA-h4m4-xp33-37mj`, `CVE-2025-43770` · Maven `com.liferay.portal:com.liferay.portal.kernel`: affected `<155.0.0`, fixed in `155.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal JSONWS API endpoint shares sensitive information](https://agentprime.io/advisories/GHSA-cv9j-mg9w-v7wm.md)
  `GHSA-cv9j-mg9w-v7wm`, `CVE-2025-43768` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<108.1.1`, fixed in `108.1.1` · CVSS 5.1 Medium · Not analysed yet · Published 23 Aug 2025 · Tags: Information disclosure
- [Liferay Portal users are able to add system admin portlets to pages](https://agentprime.io/advisories/GHSA-w3cr-3xw2-rp78.md)
  `GHSA-w3cr-3xw2-rp78`, `CVE-2025-43759` · Maven `com.liferay:com.liferay.layout.impl`: affected `<6.0.147`, fixed in `6.0.147` · CVSS 6.7 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Broken access control
- [Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry](https://agentprime.io/advisories/GHSA-mm62-gwj5-j285.md)
  `GHSA-mm62-gwj5-j285`, `CVE-2025-43758` · Maven `com.liferay:com.liferay.frontend.js.web` and 2 more: affected `<5.0.125`, fixed in `5.0.125` · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Information disclosure
- [Liferay Portal users can upload an unlimited amount of files](https://agentprime.io/advisories/GHSA-84pp-qr92-95c9.md)
  `GHSA-84pp-qr92-95c9`, `CVE-2025-43762` · Maven `com.liferay:com.liferay.dynamic.data.mapping.form.field.type` and 1 more: affected `<6.0.187`, fixed in `6.0.187` · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Denial of service
- [Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint](https://agentprime.io/advisories/GHSA-3h7r-4xxj-3mfm.md)
  `GHSA-3h7r-4xxj-3mfm`, `CVE-2025-43761` · Maven `com.liferay:com.liferay.frontend.editor.ckeditor.web` and 2 more: affected `<5.0.107`, fixed in `5.0.107` · CVSS 6.9 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect](https://agentprime.io/advisories/GHSA-fvqv-593q-qp8r.md)
  `GHSA-fvqv-593q-qp8r`, `CVE-2025-43760` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal User Enumeration Vulnerability via the Create Account Page](https://agentprime.io/advisories/GHSA-xwc5-q44v-p6gg.md)
  `GHSA-xwc5-q44v-p6gg`, `CVE-2025-43751` · Maven `com.liferay:com.liferay.login.web`: affected `<6.0.66`, fixed in `6.0.66` · CVSS 6.9 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Information disclosure
- [JeecgBoot SQL Injection Vulnerability](https://agentprime.io/advisories/GHSA-gj8w-ffq9-6828.md)
  `GHSA-gj8w-ffq9-6828`, `CVE-2025-51825` · Maven `org.jeecgframework.boot:jeecg-boot-base-core`: affected `>=3.4.3, <3.8.1`, fixed in `3.8.1` · CVSS 6.5 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: SQL injection
- [Bouncy Castle for Java has Out-of-Bounds Write Vulnerability](https://agentprime.io/advisories/GHSA-g6rx-6wfx-gj74.md)
  `GHSA-g6rx-6wfx-gj74`, `CVE-2025-9340` · Maven `org.bouncycastle:bc-fips`: affected `>=2.1.0, <2.1.1`, fixed in `2.1.1` · CVSS 0.0 None · Not analysed yet · Published 22 Aug 2025 · Tags: Memory corruption
- [Bouncy Castle for Java has Uncontrolled Resource Consumption Vulnerability](https://agentprime.io/advisories/GHSA-jfcv-jv9g-2vx2.md)
  `GHSA-jfcv-jv9g-2vx2`, `CVE-2025-9341` · Maven `org.bouncycastle:bc-fips` and 1 more: affected `>=2.1.0, <2.1.1`, fixed in `2.1.1` · CVSS 5.9 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Denial of service
- [Liferay Portal's Unlimited File Upload Could Result in DoS](https://agentprime.io/advisories/GHSA-qpp6-f3qj-rggq.md)
  `GHSA-qpp6-f3qj-rggq`, `CVE-2025-43752` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 22 Aug 2025 · Tags: Denial of service
- [Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container](https://agentprime.io/advisories/GHSA-r367-q549-pgr5.md)
  `GHSA-r367-q549-pgr5`, `CVE-2025-43753` · Maven `com.liferay:com.liferay.layout.taglib`: affected `<16.1.32`, fixed in `16.1.32` · CVSS 2.1 Low · Not analysed yet · Published 22 Aug 2025 · Tags: Cross-site scripting (XSS)
- [hippo4j Includes Hard Coded Secret Key in JWT Creation](https://agentprime.io/advisories/GHSA-48cg-9c55-j2q7.md)
  `GHSA-48cg-9c55-j2q7`, `CVE-2025-51606` · Maven `cn.hippo4j:hippo4j-core`: affected `>=1.0.0, <=1.5.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2025 · Tags: Hard-coded credentials
- [Liferay Portal Username Enumeration Vulnerability](https://agentprime.io/advisories/GHSA-x7p4-v8mj-6fxx.md)
  `GHSA-x7p4-v8mj-6fxx`, `CVE-2025-43754` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: CWE-208
- [Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter](https://agentprime.io/advisories/GHSA-q2gv-w583-f2vq.md)
  `GHSA-q2gv-w583-f2vq`, `CVE-2025-43756` · Maven `com.liferay.portal:release.portal.bom`: affected `=7.4.3.132-ga132`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter](https://agentprime.io/advisories/GHSA-58cq-8wm2-6m87.md)
  `GHSA-58cq-8wm2-6m87`, `CVE-2025-43755` · Maven `com.liferay:com.liferay.layout.admin.web`: affected `<5.0.191`, fixed in `5.0.191` · CVSS 5.1 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services](https://agentprime.io/advisories/GHSA-w2wj-hw98-233h.md)
  `GHSA-w2wj-hw98-233h` · Maven `org.keycloak:keycloak-model-storage-services`: affected `<=26.3.3`, no fixed version yet · CVSS 4.9 Medium · Withdrawn · Not analysed yet · Published 21 Aug 2025 · Tags: CWE-526
- [xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter](https://agentprime.io/advisories/GHSA-gjx6-h8hm-c9rq.md)
  `GHSA-gjx6-h8hm-c9rq`, `CVE-2025-9264` · Maven `com.xuxueli:xxl-job-admin`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Broken access control, CWE-99
- [xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-6rq7-m52p-8pqg.md)
  `GHSA-6rq7-m52p-8pqg`, `CVE-2025-9263` · Maven `com.xuxueli:xxl-job-admin`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Broken access control, CWE-99
- [Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF](https://agentprime.io/advisories/GHSA-p72g-pv48-7w9x.md)
  `GHSA-p72g-pv48-7w9x`, `CVE-2025-54988` · Maven `org.apache.tika:tika-parser-pdf-module` and 1 more: affected `>=1.13, <3.2.2`, fixed in `3.2.2` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.36 · Not analysed yet · Published 20 Aug 2025 · Tags: XML external entities (XXE)
- [Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping](https://agentprime.io/advisories/GHSA-mpww-r37c-vxjw.md)
  `GHSA-mpww-r37c-vxjw`, `CVE-2025-43746` · Maven `ccom.liferay:com.liferay.dynamic.data.mapping.web` and 1 more: affected `<5.0.122`, fixed in `5.0.122` · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter](https://agentprime.io/advisories/GHSA-62pf-hcwj-rcfc.md)
  `GHSA-62pf-hcwj-rcfc`, `CVE-2025-43757` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability](https://agentprime.io/advisories/GHSA-mmxm-8w33-wc4h.md)
  `GHSA-mmxm-8w33-wc4h`, `CVE-2025-5115` · Maven `org.eclipse.jetty.http2:http2-common` and 1 more: affected `>=9.3.0, <9.4.58 || >=10.0.0, <10.0.26 || >=11.0.0, <11.0.26`, fixed in `9.4.58`, `10.0.26`, `11.0.26` · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2025 · Tags: Denial of service
- [Liferay Portal Vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-p9gc-59hf-x48p.md)
  `GHSA-p9gc-59hf-x48p`, `CVE-2025-43748` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.0.0-a1, <7.4.3.120-ga120`, fixed in `7.4.3.120-ga120` · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal Unauthenticated File Access via URL](https://agentprime.io/advisories/GHSA-5fx5-cff6-f3fp.md)
  `GHSA-5fx5-cff6-f3fp`, `CVE-2025-43749` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Information disclosure
- [Liferay Portal Unvalidated File Upload](https://agentprime.io/advisories/GHSA-56qj-wp5r-mvhj.md)
  `GHSA-56qj-wp5r-mvhj`, `CVE-2025-43750` · Maven `com.liferay:com.liferay.dynamic.data.mapping.form.web`: affected `<4.0.180`, fixed in `4.0.180` · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Unrestricted file upload
- [Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter](https://agentprime.io/advisories/GHSA-j6p8-g3rj-ghpm.md)
  `GHSA-j6p8-g3rj-ghpm`, `CVE-2025-43741` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Cross-Site Scripting through URLs](https://agentprime.io/advisories/GHSA-3fp2-6mwq-4q3j.md)
  `GHSA-3fp2-6mwq-4q3j`, `CVE-2025-43742` · Maven `com.liferay:com.liferay.layout.type.controller.display.page`: affected `<3.0.59`, fixed in `3.0.59` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java](https://agentprime.io/advisories/GHSA-hf86-8x8v-h7vc.md)
  `GHSA-hf86-8x8v-h7vc`, `CVE-2024-39954` · Maven `org.apache.eventmesh:eventmesh-runtime`: affected `>=1.6.0-release, <=1.11.0-release`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Server-side request forgery (SSRF)
- [Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels](https://agentprime.io/advisories/GHSA-m49p-6cjp-x2h3.md)
  `GHSA-m49p-6cjp-x2h3`, `CVE-2025-43744` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Enumeration Discrepancy in Calendars](https://agentprime.io/advisories/GHSA-g4vp-4gqr-7v8c.md)
  `GHSA-g4vp-4gqr-7v8c`, `CVE-2025-43743` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Information disclosure
- [Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter](https://agentprime.io/advisories/GHSA-vjwr-cqwf-6q96.md)
  `GHSA-vjwr-cqwf-6q96`, `CVE-2025-43737` · Maven `com.liferay:com.liferay.journal.web`: affected `<5.0.196`, fixed in `5.0.196` · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal CSRF Vulnerability via Endpoint Parameter](https://agentprime.io/advisories/GHSA-7q33-gwcm-r6cj.md)
  `GHSA-7q33-gwcm-r6cj`, `CVE-2025-43745` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter](https://agentprime.io/advisories/GHSA-cwgh-r52j-xh6c.md)
  `GHSA-cwgh-r52j-xh6c`, `CVE-2025-43738` · Maven `com.liferay:com.liferay.expando.web`: affected `<=5.0.59`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Email Modification Vulnerability via Calendar Portlet](https://agentprime.io/advisories/GHSA-7mxq-h2r7-h449.md)
  `GHSA-7mxq-h2r7-h449`, `CVE-2025-43739` · Maven `com.liferay:com.liferay.calendar.service`: affected `<6.0.83`, fixed in `6.0.83` · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Information disclosure
- [Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature](https://agentprime.io/advisories/GHSA-22jp-w3cg-gvmm.md)
  `GHSA-22jp-w3cg-gvmm`, `CVE-2025-43740` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.3.120-ga120, <=7.4.3.132-ga23`, no fixed version yet · CVSS 4.6 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-3p2m-574v-v257.md)
  `GHSA-3p2m-574v-v257`, `CVE-2025-43731` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Login Bypass Vulnerability](https://agentprime.io/advisories/GHSA-g4wg-mpfg-x2q6.md)
  `GHSA-g4wg-mpfg-x2q6`, `CVE-2025-3639` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.3.0-ga1, <=7.4.3.132-ga132`, no fixed version yet · CVSS 2.0 Low · Not analysed yet · Published 18 Aug 2025 · Tags: Authentication bypass
- [Liferay Portal Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-vhcr-hgc8-29qr.md)
  `GHSA-vhcr-hgc8-29qr`, `CVE-2025-43733` · Maven `com.liferay:com.liferay.layout.taglib`: affected `<17.0.0`, fixed in `17.0.0` · CVSS 2.3 Low · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Insecure Direct Object Reference](https://agentprime.io/advisories/GHSA-v6xr-v2qg-h22h.md)
  `GHSA-v6xr-v2qg-h22h`, `CVE-2025-43732` · Maven `com.liferay:com.liferay.roles.selector.web`: affected `<5.0.32`, fixed in `5.0.32` · CVSS 4.8 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Broken access control
- [Spring Framework MVC Applications Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-r936-gwx5-v52f.md)
  `GHSA-r936-gwx5-v52f`, `CVE-2025-41242` · Maven `org.springframework:spring-webmvc`: affected `>=6.2.0, <6.2.10 || >=6.1.0, <=6.1.21 || >=6.0.0, <=6.0.29 || >=5.3.0, <=5.3.43`, fixed in `6.2.10` · CVSS 5.9 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Path traversal
- [Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability](https://agentprime.io/advisories/GHSA-v6cf-mv9h-c8mc.md)
  `GHSA-v6cf-mv9h-c8mc`, `CVE-2025-9092` · Maven `org.bouncycastle:bc-fips`: affected `>=2.1.0, <2.1.1`, fixed in `2.1.1` · CVSS 1.0 Low · Not analysed yet · Published 16 Aug 2025 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA4LTE2VDEyOjMwOjMyLjAwMDAwMFoiLCJHSFNBLXY2Y2YtbXY5aC1jOG1jIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA5LTAzVDE3OjQ1OjExLjAwMDAwMFoiLCJHSFNBLW02M2MtM3JtZy1yMmNmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA5LTAzVDE3OjQ1OjExLjAwMDAwMFoiLCJHSFNBLW02M2MtM3JtZy1yMmNmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.