# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Liferay Portal and DXP allows users to add a note to a different virtual instance](https://agentprime.io/advisories/GHSA-f372-9rcj-8w2c.md)
  `GHSA-f372-9rcj-8w2c`, `CVE-2025-43810` · Maven `com.liferay.commerce:com.liferay.commerce.service`: affected `<11.0.164`, fixed in `11.0.164` · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Broken access control
- [Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field](https://agentprime.io/advisories/GHSA-jh9h-8xf2-25wj.md)
  `GHSA-jh9h-8xf2-25wj`, `CVE-2025-43807` · Maven `com.liferay:com.liferay.change.tracking.service`: affected `<3.0.91`, fixed in `3.0.91` · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Cross-site scripting (XSS)
- [H2O affected by a deserialization vulnerability](https://agentprime.io/advisories/GHSA-5w3j-gwgh-4rfv.md)
  `GHSA-5w3j-gwgh-4rfv`, `CVE-2025-6544`, `PYSEC-2026-349` · Maven `ai.h2o:h2o-core` and 1 more: affected `<=3.46.0.7`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2025 · Tags: Insecure deserialization
- [Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource](https://agentprime.io/advisories/GHSA-chr3-w547-85hw.md)
  `GHSA-chr3-w547-85hw`, `CVE-2025-43808` · Maven `com.liferay.commerce:com.liferay.commerce.product.type.virtual.service`: affected `<4.0.47`, fixed in `4.0.47` · CVSS 6.9 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Broken access control
- [Liferay Contacts Center widget has insecure direct object reference](https://agentprime.io/advisories/GHSA-8c8v-r5jj-4425.md)
  `GHSA-8c8v-r5jj-4425`, `CVE-2025-43803` · Maven `com.liferay:com.liferay.contacts.web`: affected `<5.0.59`, fixed in `5.0.59` · CVSS 6.9 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Broken access control
- [Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-697h-3q6m-jwp4.md)
  `GHSA-697h-3q6m-jwp4`, `CVE-2025-43809` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<101.0.0`, fixed in `101.0.0` · CVSS 5.1 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Cross-site request forgery (CSRF)
- [Keycloak SMTP Inject Vulnerability](https://agentprime.io/advisories/GHSA-m4j5-5x4r-2xp9.md)
  `GHSA-m4j5-5x4r-2xp9`, `CVE-2025-8419` · Maven `org.keycloak:keycloak-services`: affected `<26.2.8 || >=26.3.0, <26.3.3`, fixed in `26.2.8`, `26.3.3` · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Other injection
- [jinjava has Sandbox Bypass via JavaType-Based Deserialization](https://agentprime.io/advisories/GHSA-m49c-g9wr-hv6v.md)
  `GHSA-m49c-g9wr-hv6v`, `CVE-2025-59340` · Maven `com.hubspot.jinjava:jinjava`: affected `>=2.8.0, <2.8.1 || >=2.7.0, <2.7.5`, fixed in `2.8.1`, `2.7.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2025 · Tags: Code injection
- [Jenkins has a log message injection vulnerability](https://agentprime.io/advisories/GHSA-qrh5-jg98-cr48.md)
  `GHSA-qrh5-jg98-cr48`, `BIT-jenkins-2025-59476`, `CVE-2025-59476` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.516.3 || >=2.517, <2.528`, fixed in `2.516.3`, `2.528` · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Other injection
- [Jenkins has a missing permission check, allowing users to obtain agent names](https://agentprime.io/advisories/GHSA-67v4-38h7-9jjp.md)
  `GHSA-67v4-38h7-9jjp`, `BIT-jenkins-2025-59474`, `CVE-2025-59474` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.516.3 || >=2.517, <2.528`, fixed in `2.516.3`, `2.528` · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Broken access control
- [Jenkins is missing a permission check in the authenticated users' profile menu](https://agentprime.io/advisories/GHSA-223m-4rfp-646h.md)
  `GHSA-223m-4rfp-646h`, `BIT-jenkins-2025-59475`, `CVE-2025-59475` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.516.3 || >=2.517, <2.528`, fixed in `2.516.3`, `2.528` · CVSS 4.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Broken access control
- [Liferay search widget vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-ccrc-5vp5-vp5j.md)
  `GHSA-ccrc-5vp5-vp5j`, `CVE-2025-43804` · Maven `com.liferay:com.liferay.portal.search`: affected `<8.0.93`, fixed in `8.0.93` · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal allows remote attackers to view display page templates via crafted URLs](https://agentprime.io/advisories/GHSA-5pp7-m8x8-rc82.md)
  `GHSA-5pp7-m8x8-rc82`, `CVE-2025-43805` · Maven `com.liferay:com.liferay.asset.display.page.service`: affected `<4.0.55`, fixed in `4.0.55` · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Broken access control
- [Timing Attack Vulnerability in SCRAM Authentication](https://agentprime.io/advisories/GHSA-3wfh-36rx-9537.md)
  `GHSA-3wfh-36rx-9537`, `CVE-2025-59432` · Maven `com.ongres.scram:scram-common`: affected `<3.2`, fixed in `3.2` · CVSS 6.6 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-208, CWE-385
- [Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC](https://agentprime.io/advisories/GHSA-95h4-8mqc-4mpf.md)
  `GHSA-95h4-8mqc-4mpf`, `CVE-2025-43801` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<101.0.0`, fixed in `101.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-606
- [JasperReports has a Java deserialisation vulnerability](https://agentprime.io/advisories/GHSA-7c3f-cg9x-f3gr.md)
  `GHSA-7c3f-cg9x-f3gr`, `CVE-2025-10492` · Maven `net.sf.jasperreports:jasperreports`: affected `<7.0.4`, fixed in `7.0.4` · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2025 · Tags: Insecure deserialization
- [Spring Expression language property modification using Spring Cloud Gateway Server WebFlux](https://agentprime.io/advisories/GHSA-q2cj-h8fw-q4cc.md)
  `GHSA-q2cj-h8fw-q4cc`, `CVE-2025-41243` · Maven `org.springframework.cloud:spring-cloud-gateway-server-webflux`: affected `>=3.1.0, <=3.1.10 || >=4.0.0, <=4.1.10 || >=4.2.0, <4.2.5 || >=4.3.0, <4.3.1`, fixed in `4.2.5`, `4.3.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2025 · Tags: Code injection
- [Spring Framework annotation detection mechanism may result in improper authorization](https://agentprime.io/advisories/GHSA-jmp9-x22r-554x.md)
  `GHSA-jmp9-x22r-554x`, `CVE-2025-41249` · Maven `org.springframework:spring-core`: affected `>=5.3.0, <=5.3.44 || >=6.0.0, <=6.1.22 || >=6.2.0, <6.2.11`, fixed in `6.2.11` · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2025 · Tags: Broken access control
- [Spring Security annotation detection mechanism has authorization bypass](https://agentprime.io/advisories/GHSA-8v5q-rhf3-jphm.md)
  `GHSA-8v5q-rhf3-jphm`, `CVE-2025-41248` · Maven `org.springframework.security:spring-security-core`: affected `>=6.4.0, <6.4.10 || >=6.5.0, <6.5.4`, fixed in `6.4.10`, `6.5.4` · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2025 · Tags: Broken access control, CWE-289
- [Openfire has potential identity spoofing issue via unsafe CN parsing](https://agentprime.io/advisories/GHSA-w252-645g-87mp.md)
  `GHSA-w252-645g-87mp`, `CVE-2025-59154` · Maven `org.igniterealtime.openfire:xmppserver`: affected `<5.0.2`, fixed in `5.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Authentication bypass
- [Liferay Stored Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-vg6h-g5mr-9hgv.md)
  `GHSA-vg6h-g5mr-9hgv`, `CVE-2025-43802` · Maven `com.liferay.workspace:com.liferay.ticket.workspace`: affected `<20240122.0632`, fixed in `20240122.0632` · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay has Insecure Default Initialization of Resource issue](https://agentprime.io/advisories/GHSA-25m3-w28p-v3v3.md)
  `GHSA-25m3-w28p-v3v3`, `CVE-2025-43797` · Maven `com.liferay:com.liferay.site.admin.web`: affected `<5.0.111`, fixed in `5.0.111` · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-1188
- [Liferay DXP Missing Critical Step in Authentication](https://agentprime.io/advisories/GHSA-4p5r-3jmm-652q.md)
  `GHSA-4p5r-3jmm-652q`, `CVE-2025-43798` · Maven `com.liferay:com.liferay.multi.factor.authentication.timebased.otp.web`: affected `<2.0.25`, fixed in `2.0.25` · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2025 · Tags: Authentication bypass
- [Liferay Portal Uses Default Password](https://agentprime.io/advisories/GHSA-43xf-59vr-g4f2.md)
  `GHSA-43xf-59vr-g4f2`, `CVE-2025-43799` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0, <7.4.3.112`, fixed in `7.4.3.112` · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-1393
- [Liferay Portal Cross-site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-jfv5-r382-xvwh.md)
  `GHSA-jfv5-r382-xvwh`, `CVE-2025-43800` · Maven `com.liferay:com.liferay.dynamic.data.mapping.form.field.type`: affected `<6.0.167`, fixed in `6.0.167` · CVSS 4.8 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal has Improper Validation of Specified Quantity in Input](https://agentprime.io/advisories/GHSA-xvgg-9h29-4g34.md)
  `GHSA-xvgg-9h29-4g34`, `CVE-2025-43793` · Maven `com.liferay.portal:com.liferay.portal.impl` and 1 more: affected `<96.0.0`, fixed in `96.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-1284
- [Liferay Portal has External Control of System or Configuration Settings](https://agentprime.io/advisories/GHSA-vp64-77c6-33h8.md)
  `GHSA-vp64-77c6-33h8`, `CVE-2025-43792` · Maven `com.liferay.portal:com.liferay.portal.kernel`: affected `<130.0.1`, fixed in `130.0.1` · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-15
- [Apache Fory Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-5hmf-8wx5-4qq3.md)
  `GHSA-5hmf-8wx5-4qq3`, `CVE-2025-59328` · Maven `org.apache.fory:fory-core`: affected `<0.12.2`, fixed in `0.12.2` · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Insecure deserialization
- [Liferay Portal vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-5c6v-fqcw-w6q5.md)
  `GHSA-5c6v-fqcw-w6q5`, `CVE-2025-43791` · Maven `com.liferay:com.liferay.dynamic.data.mapping.form.field.type`: affected `<6.0.167`, fixed in `6.0.167` · CVSS 4.8 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal has stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-r45v-2289-jgr4.md)
  `GHSA-r45v-2289-jgr4`, `CVE-2025-43794` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<99.0.0`, fixed in `99.0.0` · CVSS 4.6 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect](https://agentprime.io/advisories/GHSA-m55r-9fx8-725j.md)
  `GHSA-m55r-9fx8-725j`, `CVE-2025-43795` · Maven `com.liferay:com.liferay.configuration.admin.web` and 1 more: affected `>=2.0.7, <5.0.76`, fixed in `5.0.76` · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Open redirect
- [Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack](https://agentprime.io/advisories/GHSA-f3hf-r62c-mfrj.md)
  `GHSA-f3hf-r62c-mfrj`, `CVE-2025-43796` · Maven `com.liferay:com.liferay.portal.vulcan.api` and 1 more: affected `>=8.0.2, <40.2.0`, fixed in `40.2.0` · CVSS 7.1 High · Not analysed yet · Published 12 Sept 2025 · Tags: Denial of service
- [Liferay Portal's selection modal is vulnerable to XSS](https://agentprime.io/advisories/GHSA-g8fh-pfw3-8rmr.md)
  `GHSA-g8fh-pfw3-8rmr`, `CVE-2025-43787` · Maven `com.liferay:com.liferay.users.admin.web`: affected `>=6.0.6, <11.0.33`, fixed in `11.0.33` · CVSS 5.1 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal's Organization Selector exposes organization data to remote authenticated users](https://agentprime.io/advisories/GHSA-v53g-736w-mgw4.md)
  `GHSA-v53g-736w-mgw4`, `CVE-2025-43788` · Maven `com.liferay:com.liferay.organizations.item.selector.web`: affected `>=4.0.2, <4.0.22`, fixed in `4.0.22` · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Broken access control
- [Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution](https://agentprime.io/advisories/GHSA-q86r-gwqc-jx85.md)
  `GHSA-q86r-gwqc-jx85`, `CVE-2025-43789` · Maven `com.liferay:com.liferay.comment.web`: affected `>=6.0.2, <6.1.4`, fixed in `6.1.4` · CVSS 1.0 Low · Not analysed yet · Published 12 Sept 2025 · Tags: Broken access control
- [Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name](https://agentprime.io/advisories/GHSA-wr8m-5h2p-4432.md)
  `GHSA-wr8m-5h2p-4432`, `CVE-2025-43782` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl`: affected `>=5.0.1, <5.0.48`, fixed in `5.0.48` · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Broken access control
- [Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass](https://agentprime.io/advisories/GHSA-5wxc-3jfw-w94p.md)
  `GHSA-5wxc-3jfw-w94p`, `CVE-2025-43790` · Maven `com.liferay:com.liferay.object.service`: affected `<1.0.197`, fixed in `1.0.197` · CVSS 7.4 High · Not analysed yet · Published 11 Sept 2025 · Tags: Broken access control
- [Liferay Portal is vulnerable to Reflected XSS attack through get_editor path](https://agentprime.io/advisories/GHSA-jhgr-j9cj-8j62.md)
  `GHSA-jhgr-j9cj-8j62`, `CVE-2025-43783` · Maven `com.liferay:com.liferay.frontend.editor.ckeditor.web`: affected `>=5.0.76, <5.0.102`, fixed in `5.0.102` · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data](https://agentprime.io/advisories/GHSA-fvp7-jj9m-3qpf.md)
  `GHSA-fvp7-jj9m-3qpf`, `CVE-2025-43784` · Maven `com.liferay:com.liferay.headless.builder.impl`: affected `<1.0.32`, fixed in `1.0.32` · CVSS 6.2 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: Broken access control
- [Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-66x6-8jgv-qpfh.md)
  `GHSA-66x6-8jgv-qpfh`, `CVE-2025-43785` · Maven `com.liferay:com.liferay.portal.workflow.task.web` and 2 more: affected `<5.0.75`, fixed in `5.0.75` · CVSS 4.6 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal exposes ERC which can lead to exploit the time response attack](https://agentprime.io/advisories/GHSA-9p7x-8c57-4pqv.md)
  `GHSA-9p7x-8c57-4pqv`, `CVE-2025-43786` · Maven `com.liferay:com.liferay.headless.admin.workflow.impl` and 2 more: affected `>=5.0.4, <5.0.83`, fixed in `5.0.83` · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS), Information disclosure, CWE-208
- [Liferay Portal is vulnerable to XSS attack through its search bar portlet](https://agentprime.io/advisories/GHSA-x5fw-8xgx-q6c9.md)
  `GHSA-x5fw-8xgx-q6c9`, `CVE-2025-43781` · Maven `com.liferay:com.liferay.portal.search.web`: affected `>=6.0.125, <6.0.143`, fixed in `6.0.143` · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to XSS attacks via its remote app title field](https://agentprime.io/advisories/GHSA-88g3-pv3w-5wmr.md)
  `GHSA-88g3-pv3w-5wmr`, `CVE-2025-43775` · Maven `com.liferay:com.liferay.client.extension.web`: affected `>=1.0.71, <2.0.27`, fixed in `2.0.27` · CVSS 4.6 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Apache DolphinScheduler vulnerable to Alert Script Attack](https://agentprime.io/advisories/GHSA-3vcp-r62v-xpvg.md)
  `GHSA-3vcp-r62v-xpvg`, `CVE-2024-43115` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-20
- [Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting](https://agentprime.io/advisories/GHSA-rcc7-jx7p-hrv4.md)
  `GHSA-rcc7-jx7p-hrv4`, `CVE-2025-43776` · Maven `com.liferay:com.liferay.portal.workflow.web` and 2 more: affected `<4.0.94`, fixed in `4.0.94` · CVSS 4.6 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS), Information disclosure
- [Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin](https://agentprime.io/advisories/GHSA-cpg4-qcj8-42gp.md)
  `GHSA-cpg4-qcj8-42gp`, `CVE-2025-43778` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.forms.web`: affected `>=5.0.3, <5.0.107`, fixed in `5.0.107` · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal exposes 500 status when attempting login with a deleted client secret](https://agentprime.io/advisories/GHSA-9vwq-j6gq-w9xh.md)
  `GHSA-9vwq-j6gq-w9xh`, `CVE-2025-43777` · Maven `com.liferay:com.liferay.portal.security.sso.openid.connect.impl`: affected `>=6.0.4, <7.0.48`, fixed in `7.0.48` · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Information disclosure
- [Liferay Portal is vulnerable to XSS attack through its Style Book theme](https://agentprime.io/advisories/GHSA-qgj5-4qvg-2f8c.md)
  `GHSA-qgj5-4qvg-2f8c`, `CVE-2025-43774` · Maven `com.liferay:com.liferay.frontend.taglib.clay`: affected `<15.2.1`, fixed in `15.2.1` · CVSS 4.0, no score published · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to SSRF through custom object attachment fields](https://agentprime.io/advisories/GHSA-477q-x55m-j38g.md)
  `GHSA-477q-x55m-j38g`, `CVE-2025-43763` · Maven `com.liferay:com.liferay.object.service`: affected `<1.0.208`, fixed in `1.0.208` · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Server-side request forgery (SSRF)
- [XWiki Blog Application: Privilege Escalation (PR) from account through blog content](https://agentprime.io/advisories/GHSA-gwj6-xpfg-pxwr.md)
  `GHSA-gwj6-xpfg-pxwr`, `CVE-2025-58365` · Maven `org.xwiki.contrib.blog:application-blog-ui`: affected `<9.14`, fixed in `9.14` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2025 · Tags: Code injection, Privilege escalation
- [Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-cxvc-g8f2-4gmm.md)
  `GHSA-cxvc-g8f2-4gmm`, `CVE-2025-58782` · Maven `org.apache.jackrabbit:jackrabbit-core` and 1 more: affected `>=1.0.0, <2.22.2`, fixed in `2.22.2` · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Insecure deserialization
- [Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks](https://agentprime.io/advisories/GHSA-xmcw-mv9p-7pq2.md)
  `GHSA-xmcw-mv9p-7pq2` · Maven `org.keycloak:keycloak-account-ui` and 1 more: affected `<26.2.9 || >=26.3.0, <26.3.4`, fixed in `26.2.9`, `26.3.4` · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site scripting (XSS)
- [FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side](https://agentprime.io/advisories/GHSA-rrw2-px9j-qffj.md)
  `GHSA-rrw2-px9j-qffj`, `CVE-2025-58369` · Maven `co.fs2:fs2-io_0.26` and 10 more: affected `*`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Denial of service
- [Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions](https://agentprime.io/advisories/GHSA-fghv-69vj-qj49.md)
  `GHSA-fghv-69vj-qj49`, `CVE-2025-58056` · Maven `io.netty:netty-codec-http`: affected `<4.1.125.Final || >=4.2.0.Alpha1, <4.2.5.Final`, fixed in `4.1.125.Final`, `4.2.5.Final` · CVSS 2.9 Low · Not analysed yet · Published 4 Sept 2025 · Tags: HTTP request smuggling
- [Vaadin Platform possible file bypass via upload validation on the server-side](https://agentprime.io/advisories/GHSA-c7v7-rqfm-f44j.md)
  `GHSA-c7v7-rqfm-f44j` · Maven `com.vaadin:vaadin`: affected `>=14.0.0, <14.13.1 || >=23.0.0, <23.6.2 || >=24.0.0, <24.7.7`, fixed in `14.13.1`, `23.6.2`, `24.7.7` · CVSS 4.0, no score published · Not analysed yet · Published 4 Sept 2025 · Tags: Unrestricted file upload, CWE-20
- [Vaadin Flow Components possible file bypass via upload validation on the server-side](https://agentprime.io/advisories/GHSA-94g8-xv23-7656.md)
  `GHSA-94g8-xv23-7656` · Maven `com.vaadin:vaadin-upload-flow`: affected `>=2.0.0, <14.13.1 || >=23.0.0, <23.6.2 || >=24.0.0, <24.7.7`, fixed in `14.13.1`, `23.6.2`, `24.7.7` · CVSS 4.0, no score published · Not analysed yet · Published 4 Sept 2025 · Tags: Unrestricted file upload, CWE-20
- [Vaadin Framework possible file bypass via upload validation on the server-side](https://agentprime.io/advisories/GHSA-9gfh-4fwj-w3rj.md)
  `GHSA-9gfh-4fwj-w3rj`, `CVE-2025-9467` · Maven `com.vaadin:vaadin-server`: affected `>=7.0.0, <7.7.48 || >=8.0.0, <8.28.2`, fixed in `7.7.48`, `8.28.2` · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Unrestricted file upload, CWE-20
- [Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin](https://agentprime.io/advisories/GHSA-j4fw-4mhr-hc45.md)
  `GHSA-j4fw-4mhr-hc45`, `CVE-2025-43772` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.forms.web`: affected `<5.0.29`, fixed in `5.0.29` · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2025 · Tags: Denial of service
- [Netty's decoders vulnerable to DoS via zip bomb style attack](https://agentprime.io/advisories/GHSA-3p8m-j85q-pgmj.md)
  `GHSA-3p8m-j85q-pgmj`, `CVE-2025-58057` · Maven `io.netty:netty-codec` and 1 more: affected `<4.1.125.Final`, fixed in `4.1.125.Final` · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-409
- [XWiki configuration files can be accessed through jsx and sx endpoints](https://agentprime.io/advisories/GHSA-m63c-3rmg-r2cf.md)
  `GHSA-m63c-3rmg-r2cf`, `CVE-2025-55748` · Maven `org.xwiki.platform:xwiki-platform-skin-skinx`: affected `>=4.2-milestone-2, <16.10.7`, fixed in `16.10.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2025 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA5LTAzVDE3OjQ1OjExLjAwMDAwMFoiLCJHSFNBLW02M2MtM3JtZy1yMmNmIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTA5LTIzVDAwOjMyOjAzLjAwMDAwMFoiLCJHSFNBLXBoNjMtY2h2di04eDQ2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTA5LTIzVDAwOjMyOjAzLjAwMDAwMFoiLCJHSFNBLXBoNjMtY2h2di04eDQ2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.