# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [GeoIP processor disables SSL certificate validation when downloading databases](https://agentprime.io/advisories/GHSA-3xgr-h5hq-7299.md)
  `GHSA-3xgr-h5hq-7299` · Maven `org.opensearch.dataprepper.plugins:geoip-processor`: affected `>=2.7.0, <2.12.2`, fixed in `2.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Weak cryptography or TLS
- [OpenSearch Data Prepper uses deprecated SSL protocol identifier](https://agentprime.io/advisories/GHSA-28gg-8qqj-fhh5.md)
  `GHSA-28gg-8qqj-fhh5` · Maven `org.opensearch.dataprepper.plugins:geoip-processor`: affected `>=2.4.0, <2.12.2`, fixed in `2.12.2` · CVSS 4.8 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Weak cryptography or TLS
- [OpenSearch Data Prepper plugins trust all SSL certificates by default](https://agentprime.io/advisories/GHSA-43ff-rr26-8hx4.md)
  `GHSA-43ff-rr26-8hx4`, `CVE-2025-62371` · Maven `org.opensearch.dataprepper.plugins:opensearch`: affected `<2.12.2`, fixed in `2.12.2` · CVSS 7.4 High · Not analysed yet · Published 15 Oct 2025 · Tags: Weak cryptography or TLS
- [Netty has SMTP Command Injection Vulnerability that Allows Email Forgery](https://agentprime.io/advisories/GHSA-jq43-27x9-3v86.md)
  `GHSA-jq43-27x9-3v86`, `CVE-2025-59419` · Maven `io.netty:netty-codec-smtp`: affected `>=4.2.0.Alpha1, <4.2.7.Final || <4.1.128.Final`, fixed in `4.2.7.Final`, `4.1.128.Final` · CVSS 5.5 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Command injection, Other injection
- [JDBC Driver for SQL Server has improper input validation issue](https://agentprime.io/advisories/GHSA-m494-w24q-6f7w.md)
  `GHSA-m494-w24q-6f7w`, `CVE-2025-59250` · Maven `com.microsoft.sqlserver:mssql-jdbc`: affected `>=8.3.0.jre11-preview, <10.2.4.jre11 || >=11.2.0.jre11, <11.2.4.jre11 || >=12.2.0.jre11, <12.2.1.jre11 || >=12.6.0.jre11, <12.6.5.jre11 || >=12.8.0.jre11, <12.8.2.jre11 || >=12.10.0.jre11, <12.10.2.jre11 || >=13.2.0.jre11, <13.2.1.jre11`, fixed in `10.2.4.jre11`, `11.2.4.jre11`, `12.2.1.jre11`, `12.6.5.jre11`, `12.8.2.jre11`, `12.10.2.jre11`, `13.2.1.jre11` · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-20
- [Apache Geode web-api is vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-w595-4975-gm3h.md)
  `GHSA-w595-4975-gm3h`, `CVE-2024-44088` · Maven `org.apache.geode:geode-web-api`: affected `>=1.1.0, <1.15.2`, fixed in `1.15.2` · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay has Incorrect Permission Assignment for Critical Resource](https://agentprime.io/advisories/GHSA-j4f7-gj7q-xg9m.md)
  `GHSA-j4f7-gj7q-xg9m`, `CVE-2025-62251` · Maven `com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary`: affected `<1.0.23`, fixed in `1.0.23` · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-pfwq-mr9g-gq6m.md)
  `GHSA-pfwq-mr9g-gq6m`, `CVE-2025-62252` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<99.0.0`, fixed in `99.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Broken access control
- [Liferay Mentions Web is Vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-mj68-2xr5-28xh.md)
  `GHSA-mj68-2xr5-28xh`, `CVE-2025-62246` · Maven `com.liferay:com.liferay.mentions.web`: affected `<6.0.35`, fixed in `6.0.35` · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-fhcw-px4q-pmvv.md)
  `GHSA-fhcw-px4q-pmvv`, `CVE-2025-62241` · Maven `com.liferay.commerce:com.liferay.commerce.order.content.web`: affected `<4.0.114`, fixed in `4.0.114` · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Broken access control
- [Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-3cm9-jrf5-h2cx.md)
  `GHSA-3cm9-jrf5-h2cx`, `CVE-2025-62242` · Maven `com.liferay:com.liferay.change.tracking.web`: affected `<2.0.120`, fixed in `2.0.120` · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Broken access control
- [Liferay Publications is vulnerable to Incorrect Authorization](https://agentprime.io/advisories/GHSA-894w-w643-qvxv.md)
  `GHSA-894w-w643-qvxv`, `CVE-2025-62243` · Maven `com.liferay:com.liferay.change.tracking.web`: affected `<2.0.122`, fixed in `2.0.122` · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Broken access control
- [Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-2hfj-jv6q-762v.md)
  `GHSA-2hfj-jv6q-762v`, `CVE-2025-62244` · Maven `com.liferay:com.liferay.change.tracking.web`: affected `<2.0.122`, fixed in `2.0.122` · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: Broken access control
- [Liferay Portal is vulnerable to CSRF through publication comments](https://agentprime.io/advisories/GHSA-9676-rh83-cr86.md)
  `GHSA-9676-rh83-cr86`, `CVE-2025-62245` · Maven `com.liferay:com.liferay.change.tracking.web`: affected `>=2.0.9, <2.0.121`, fixed in `2.0.121` · CVSS 5.1 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [PowerJob OpenAPIController is missing authorization](https://agentprime.io/advisories/GHSA-9wq6-87hw-6mhc.md)
  `GHSA-9wq6-87hw-6mhc`, `CVE-2025-11581` · Maven `tech.powerjob:powerjob-server-starter`: affected `<=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Broken access control
- [PowerJob has Missing Authorization in its /user/list file](https://agentprime.io/advisories/GHSA-87xj-ghmc-c3xq.md)
  `GHSA-87xj-ghmc-c3xq`, `CVE-2025-11580` · Maven `tech.powerjob:powerjob`: affected `<=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Broken access control
- [Liferay Portal's Membership page is vulnerable to XSS through “name“ text field](https://agentprime.io/advisories/GHSA-xw6m-3m5q-mxpm.md)
  `GHSA-xw6m-3m5q-mxpm`, `CVE-2025-62238` · Maven `com.liferay:com.liferay.account.admin.web`: affected `>=2.0.40, <2.0.114`, fixed in `2.0.114` · CVSS 4.8 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to XSS through its workflow process builder](https://agentprime.io/advisories/GHSA-xcvw-hh99-qm73.md)
  `GHSA-xcvw-hh99-qm73`, `CVE-2025-62239` · Maven `com.liferay:com.liferay.portal.workflow.kaleo.designer.web`: affected `>=5.0.56, <5.0.124`, fixed in `5.0.124` · CVSS 4.6 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Commerce is vulnerable to XSS through account "name" field](https://agentprime.io/advisories/GHSA-m4g9-5mg6-gfr3.md)
  `GHSA-m4g9-5mg6-gfr3`, `CVE-2025-62237` · Maven `com.liferay.commerce:com.liferay.commerce.order.web`: affected `>=5.0.29, <5.0.101`, fixed in `5.0.101` · CVSS 4.8 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability](https://agentprime.io/advisories/GHSA-6wwv-6mm3-pp76.md)
  `GHSA-6wwv-6mm3-pp76`, `CVE-2025-30001` · Maven `org.apache.streampark:streampark`: affected `<=2.1.5`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-279
- [Elasticsearch: Insertion of Sensitive Information into Log File via reindex API](https://agentprime.io/advisories/GHSA-56r7-h6mw-rcfv.md)
  `GHSA-56r7-h6mw-rcfv`, `BIT-elasticsearch-2025-37727`, `CVE-2025-37727` · Maven `org.elasticsearch.plugin:reindex-client`: affected `>=7.0.0, <8.18.8 || >=8.19.0, <8.19.5 || >=9.0.0-beta1, <9.0.8 || >=9.1.0, <9.1.5`, fixed in `8.18.8`, `8.19.5`, `9.0.8`, `9.1.5` · CVSS 5.7 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Information disclosure
- [Liferay Portal is vulnerable to XSS through its Calendar Events parameters](https://agentprime.io/advisories/GHSA-5264-m964-7pg9.md)
  `GHSA-5264-m964-7pg9`, `CVE-2025-62240` · Maven `com.liferay:com.liferay.calendar.web`: affected `>=5.0.45, <5.0.88`, fixed in `5.0.88` · CVSS 4.8 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers](https://agentprime.io/advisories/GHSA-wqm3-w3p6-xjgm.md)
  `GHSA-wqm3-w3p6-xjgm`, `CVE-2025-62228` · Maven `org.apache.flink:flink-cdc-pipeline-connectors` and 4 more: affected `>=3.0.0, <3.5.0`, fixed in `3.5.0` · CVSS 5.1 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: SQL injection
- [Keycloak Potential Variable Reference in Model Storage Services](https://agentprime.io/advisories/GHSA-8hxp-qmph-w5gq.md)
  `GHSA-8hxp-qmph-w5gq`, `CVE-2025-9162` · Maven `org.keycloak:keycloak-model-storage-services`: affected `* || >=26.3.0, <26.3.4`, fixed in `26.3.4` · CVSS 4.9 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: CWE-526
- [Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-m2vg-rmq6-p62r.md)
  `GHSA-m2vg-rmq6-p62r`, `CVE-2025-61788` · Maven `org.opencastproject:opencast-common`: affected `<=16.10`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields](https://agentprime.io/advisories/GHSA-q8fj-76q7-4p7h.md)
  `GHSA-q8fj-76q7-4p7h`, `CVE-2025-43771` · Maven `com.liferay:com.liferay.flags.web`: affected `>=6.0.23, <6.0.24`, fixed in `6.0.24` · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file](https://agentprime.io/advisories/GHSA-893r-jr58-3hxr.md)
  `GHSA-893r-jr58-3hxr`, `CVE-2025-43829` · Maven `com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web`: affected `>=1.0.41, <1.0.83`, fixed in `1.0.83` · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to Stored XSS through Forms text type field](https://agentprime.io/advisories/GHSA-378f-8q54-3fqx.md)
  `GHSA-378f-8q54-3fqx`, `CVE-2025-43830` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.3.2, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field](https://agentprime.io/advisories/GHSA-fjrp-77f3-43xj.md)
  `GHSA-fjrp-77f3-43xj`, `CVE-2025-43821` · Maven `com.liferay.commerce:com.liferay.commerce.product.service`: affected `>=6.0.5, <6.0.134`, fixed in `6.0.134` · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to XSS through its Commerce Search Result widget](https://agentprime.io/advisories/GHSA-xx7h-2wf7-hc7p.md)
  `GHSA-xx7h-2wf7-hc7p`, `CVE-2025-43823` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page](https://agentprime.io/advisories/GHSA-4mqx-4p8g-995w.md)
  `GHSA-4mqx-4p8g-995w`, `CVE-2025-43822` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.3.15, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Profile Widget does not prevent vCard extension spoofing](https://agentprime.io/advisories/GHSA-pfxj-gvqg-mj44.md)
  `GHSA-pfxj-gvqg-mj44`, `CVE-2025-43824` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 4.8 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Cross-site scripting (XSS)
- [XWiki Platform is vulnerable to HQL injection via wiki and space search REST API](https://agentprime.io/advisories/GHSA-gprp-h92g-gc2h.md)
  `GHSA-gprp-h92g-gc2h`, `CVE-2025-52472` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=17.0.0-rc-1, <17.4.2 || >=4.3-milestone-1, <16.10.9`, fixed in `17.4.2`, `16.10.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2025 · Tags: SQL injection
- [XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view](https://agentprime.io/advisories/GHSA-f2hf-pfrj-vrm7.md)
  `GHSA-f2hf-pfrj-vrm7`, `CVE-2025-49594` · Maven `org.xwiki.contrib.oidc:oidc-authenticator`: affected `>=2.17.1, <2.18.2`, fixed in `2.18.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2025 · Tags: Broken access control
- [Liferay Portal exposes sensitive user data through its Freemarker template](https://agentprime.io/advisories/GHSA-rggc-gf6w-9q73.md)
  `GHSA-rggc-gf6w-9q73`, `CVE-2025-43825` · Maven `com.liferay:com.liferay.portal.template.freemarker`: affected `>=7.0.3, <7.0.60`, fixed in `7.0.60` · CVSS 4.6 Medium · Not analysed yet · Published 4 Oct 2025 · Tags: Information disclosure
- [Apache Kylin Files or Directories Accessible to External Parties](https://agentprime.io/advisories/GHSA-p86w-w5rh-m3hx.md)
  `GHSA-p86w-w5rh-m3hx`, `CVE-2025-61734` · Maven `org.apache.kylin:kylin` and 6 more: affected `>=4.0.0, <5.0.3`, fixed in `5.0.3` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 2 Oct 2025 · Tags: Information disclosure
- [Apache Kylin Authentication Bypass Vulnerability](https://agentprime.io/advisories/GHSA-mr9j-4j48-xcm2.md)
  `GHSA-mr9j-4j48-xcm2`, `CVE-2025-61733` · Maven `org.apache.kylin:kylin` and 1 more: affected `>=4.0.0, <5.0.3`, fixed in `5.0.3` · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2025 · Tags: Authentication bypass
- [Apache Kylin Server-Side Request Forgery (SSRF) Vulnerability](https://agentprime.io/advisories/GHSA-f6m8-qm7j-fh65.md)
  `GHSA-f6m8-qm7j-fh65`, `CVE-2025-61735` · Maven `org.apache.kylin:kylin` and 6 more: affected `>=4.0.0, <5.0.3`, fixed in `5.0.3` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2025 · Tags: Server-side request forgery (SSRF)
- [QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing](https://agentprime.io/advisories/GHSA-25qh-j22f-pwp8.md)
  `GHSA-25qh-j22f-pwp8`, `CVE-2025-11226` · Maven `ch.qos.logback:logback-core`: affected `>=1.4.0, <1.5.19 || <1.3.16`, fixed in `1.5.19`, `1.3.16` · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2025 · Tags: CWE-20
- [Liferay Portal Vulnerable to XSS in Web Content translation](https://agentprime.io/advisories/GHSA-qh92-cr5f-3595.md)
  `GHSA-qh92-cr5f-3595`, `CVE-2025-43826` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.113-ga113`, fixed in `7.4.3.113-ga113` · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to IDOR via audit events](https://agentprime.io/advisories/GHSA-pw86-qvx9-34r7.md)
  `GHSA-pw86-qvx9-34r7`, `CVE-2025-43827` · Maven `com.liferay:com.liferay.portal.security.audit.storage.service` and 1 more: affected `>=6.0.4, <6.0.41`, fixed in `6.0.41` · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Broken access control
- [Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page](https://agentprime.io/advisories/GHSA-wmjx-xv9v-r89q.md)
  `GHSA-wmjx-xv9v-r89q`, `CVE-2025-43815` · Maven `com.liferay:com.liferay.product.navigation.control.menu.web`: affected `>=6.0.80, <6.0.83`, fixed in `6.0.83` · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to cross-site scripting in the Calendar widget](https://agentprime.io/advisories/GHSA-pf86-4w35-cj89.md)
  `GHSA-pf86-4w35-cj89`, `CVE-2025-43820` · Maven `com.liferay:com.liferay.calendar.web` and 1 more: affected `>=5.0.45, <5.0.88`, fixed in `5.0.88` · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to reflected cross-site scripting via the \`redirect\` parameter](https://agentprime.io/advisories/GHSA-m4hg-46pw-6mmv.md)
  `GHSA-m4hg-46pw-6mmv`, `CVE-2025-43817` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.3.74-ga74, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to cross-site scripting in the web content template](https://agentprime.io/advisories/GHSA-jv8x-mm3v-75r7.md)
  `GHSA-jv8x-mm3v-75r7`, `CVE-2025-43812` · Maven `com.liferay:com.liferay.journal.web` and 1 more: affected `>=5.0.34, <5.0.161`, fixed in `5.0.161` · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to cross-site scripting in the Calendar widget](https://agentprime.io/advisories/GHSA-gj92-p9mh-83j8.md)
  `GHSA-gj92-p9mh-83j8`, `CVE-2025-43818` · Maven `com.liferay:com.liferay.calendar.web`: affected `>=5.0.45, <5.0.87`, fixed in `5.0.87` · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet](https://agentprime.io/advisories/GHSA-2hm7-r8f3-423h.md)
  `GHSA-2hm7-r8f3-423h`, `CVE-2025-43813` · Maven `com.liferay.portal:com.liferay.portal.impl` and 1 more: affected `<96.0.0`, fixed in `96.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Path traversal
- [Liferay Portal vulnerable to cross-site scripting in the related asset selector](https://agentprime.io/advisories/GHSA-2856-xf2f-6vrf.md)
  `GHSA-2856-xf2f-6vrf`, `CVE-2025-43811` · Maven `com.liferay:com.liferay.item.selector.web`: affected `>=7.0.35, <7.0.52`, fixed in `7.0.52` · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Cross-site scripting (XSS)
- [MinIO Java Client XML Tag Value Substitution Vulnerability](https://agentprime.io/advisories/GHSA-h7rh-xfpj-hpcm.md)
  `GHSA-h7rh-xfpj-hpcm`, `CVE-2025-59952` · Maven `io.minio:minio`: affected `<8.6.0`, fixed in `8.6.0` · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2025 · Tags: Other injection, Code injection, CWE-20
- [WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled](https://agentprime.io/advisories/GHSA-w82p-r9vw-4rg5.md)
  `GHSA-w82p-r9vw-4rg5`, `CVE-2025-1396` · Maven `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt`: affected `<=7.8.103`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 26 Sept 2025 · Tags: Information disclosure
- [Hutool allows remote code execution (RCE) via the QLExpressEngine class](https://agentprime.io/advisories/GHSA-gcfh-36x4-mgj6.md)
  `GHSA-gcfh-36x4-mgj6`, `CVE-2025-56769` · Maven `cn.hutool:hutool-extra`: affected `<5.8.40`, fixed in `5.8.40` · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Command injection, Code injection
- [Liferay Portal and DXP vulnerable to a memory leak](https://agentprime.io/advisories/GHSA-hrqm-qpw9-w8rv.md)
  `GHSA-hrqm-qpw9-w8rv`, `CVE-2025-43816` · Maven `com.liferay:com.liferay.portal.vulcan.impl`: affected `<5.0.115`, fixed in `5.0.115` · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Denial of service
- [Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands](https://agentprime.io/advisories/GHSA-2hmj-97jw-28jh.md)
  `GHSA-2hmj-97jw-28jh`, `BIT-zookeeper-2025-58457`, `CVE-2025-58457` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.9.0, <3.9.4`, fixed in `3.9.4` · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-280
- [Apache IoTDB: DoS Vulnerability](https://agentprime.io/advisories/GHSA-vx84-xvr8-w24c.md)
  `GHSA-vx84-xvr8-w24c`, `CVE-2025-48392` · Maven `org.apache.iotdb:iotdb-core`: affected `>=1.3.3, <2.0.5`, fixed in `2.0.5` · CVSS 7.5 High · Not analysed yet · Published 24 Sept 2025 · Tags: Denial of service, CWE-20
- [Liferay Portal and DXP does not properly expire sessions](https://agentprime.io/advisories/GHSA-rpx3-f938-xj5q.md)
  `GHSA-rpx3-f938-xj5q`, `CVE-2025-43819` · Maven `com.liferay:com.liferay.saml.impl`: affected `<5.0.51`, fixed in `5.0.51` · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: Authentication bypass
- [WSO2 Identity Server Apps allows content spoofing in logs](https://agentprime.io/advisories/GHSA-r6f3-55wj-g9p3.md)
  `GHSA-r6f3-55wj-g9p3`, `CVE-2024-6429` · Maven `org.wso2.identity.apps:authentication-portal`: affected `<2.4.4`, fixed in `2.4.4` · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-451
- [Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section](https://agentprime.io/advisories/GHSA-wcwh-7gfw-5wrr.md)
  `GHSA-wcwh-7gfw-5wrr`, `CVE-2025-59822` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.31`, fixed in `0.23.31` · CVSS 6.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: HTTP request smuggling
- [WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-cmjc-qp7j-xgwr.md)
  `GHSA-cmjc-qp7j-xgwr`, `CVE-2025-4760` · Maven `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api` and 1 more: affected `<9.31.117`, fixed in `9.31.117` · CVSS 4.8 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and DXP does not properly check permission with import and export tasks](https://agentprime.io/advisories/GHSA-pm45-xx4q-fmv7.md)
  `GHSA-pm45-xx4q-fmv7`, `CVE-2025-43806` · Maven `com.liferay:com.liferay.batch.engine.service` and 1 more: affected `<4.0.102`, fixed in `4.0.102` · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Broken access control
- [Liferay Portal and DXP audit events record password reminder answers](https://agentprime.io/advisories/GHSA-ph63-chvv-8x46.md)
  `GHSA-ph63-chvv-8x46`, `CVE-2025-43814` · Maven `com.liferay:com.liferay.portal.security.audit.event.generators.user.management`: affected `<5.0.13`, fixed in `5.0.13` · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTA5LTIzVDAwOjMyOjAzLjAwMDAwMFoiLCJHSFNBLXBoNjMtY2h2di04eDQ2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTEwLTE2VDE1OjMwOjQzLjAwMDAwMFoiLCJHSFNBLTdmY2gtNGYyZi1qY2dtIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTEwLTE2VDE1OjMwOjQzLjAwMDAwMFoiLCJHSFNBLTdmY2gtNGYyZi1qY2dtIl0>. Everything for agents: <https://agentprime.io/llms.txt>.