# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Liferay Portal is vulnerable to DNS rebinding attacks](https://agentprime.io/advisories/GHSA-f5vh-4rj2-w8r8.md)
  `GHSA-f5vh-4rj2-w8r8`, `CVE-2025-62266` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.110`, fixed in `7.4.3.110` · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Open redirect
- [Liferay Portal vulnerable to password enumeration](https://agentprime.io/advisories/GHSA-8hw3-ghwv-crfh.md)
  `GHSA-8hw3-ghwv-crfh`, `CVE-2025-62257` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.120`, fixed in `7.4.3.120` · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Authentication bypass
- [Jenkins Publish to Bitbucket Plugin is missing a permissions check](https://agentprime.io/advisories/GHSA-wpr5-rc2j-99p2.md)
  `GHSA-wpr5-rc2j-99p2`, `CVE-2025-64150` · Maven `org.jenkins-ci.plugins:publish-to-bitbucket`: affected `<=0.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins Publish to Bitbucket Plugin is missing a permissions check](https://agentprime.io/advisories/GHSA-v549-7pm5-f8qr.md)
  `GHSA-v549-7pm5-f8qr`, `CVE-2025-64148` · Maven `org.jenkins-ci.plugins:publish-to-bitbucket`: affected `<=0.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check](https://agentprime.io/advisories/GHSA-m244-6mff-p355.md)
  `GHSA-m244-6mff-p355`, `CVE-2025-64149` · Maven `org.jenkins-ci.plugins:publish-to-bitbucket`: affected `<=0.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form](https://agentprime.io/advisories/GHSA-hv42-crpx-q355.md)
  `GHSA-hv42-crpx-q355`, `CVE-2025-64147` · Maven `org.jenkins-ci.plugins:curseforge-publisher`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Weak cryptography or TLS
- [Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery](https://agentprime.io/advisories/GHSA-x2pv-fph3-phfx.md)
  `GHSA-x2pv-fph3-phfx`, `CVE-2025-64141` · Maven `org.jenkins-ci.plugins:nexus-task-runner`: affected `<=0.9.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Eggplant Runner Plugin protection mechanism disabled](https://agentprime.io/advisories/GHSA-w5r3-gr8w-7fj5.md)
  `GHSA-w5r3-gr8w-7fj5`, `CVE-2025-64135` · Maven `io.jenkins.plugins:eggplant-runner`: affected `<=0.0.1.301.v963cffe8ddb`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: CWE-1188
- [Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form](https://agentprime.io/advisories/GHSA-vmm2-53rc-43v3.md)
  `GHSA-vmm2-53rc-43v3`, `CVE-2025-64145` · Maven `io.jenkins.plugins:byteguard-build-actions`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Weak cryptography or TLS
- [Jenkins Azure CLI Plugin does not restrict the commands it executes](https://agentprime.io/advisories/GHSA-rh72-238f-g26q.md)
  `GHSA-rh72-238f-g26q`, `CVE-2025-64140` · Maven `org.jenkins-ci.plugins:azure-cli`: affected `<=0.9`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2025 · Tags: Command injection
- [Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools](https://agentprime.io/advisories/GHSA-mrpq-9jr3-rqq9.md)
  `GHSA-mrpq-9jr3-rqq9`, `CVE-2025-64132` · Maven `io.jenkins.plugins:mcp-server`: affected `<0.86.v7d3355e6a`, fixed in `0.86.v7d3355e6a` · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins Start Windocks Containers Plugin is missing a permission check](https://agentprime.io/advisories/GHSA-mj6v-4wr4-gj57.md)
  `GHSA-mj6v-4wr4-gj57`, `CVE-2025-64139` · Maven `org.jenkins-ci.plugins:windocks-start-container`: affected `<=1.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins Themis Plugin is missing a permission check](https://agentprime.io/advisories/GHSA-jwm4-955w-4hj3.md)
  `GHSA-jwm4-955w-4hj3`, `CVE-2025-64137` · Maven `org.jenkins-ci.plugins:themis`: affected `<=1.4.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins JDepend Plugin vulnerable to XML external entity attacks](https://agentprime.io/advisories/GHSA-jfg6-4gx3-3v7w.md)
  `GHSA-jfg6-4gx3-3v7w`, `CVE-2025-64134` · Maven `org.jenkins-ci.plugins:jdepend`: affected `<=1.3.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2025 · Tags: XML external entities (XXE)
- [Jenkins SAML Plugin does not implement a replay cache](https://agentprime.io/advisories/GHSA-j7r7-7qmf-xq87.md)
  `GHSA-j7r7-7qmf-xq87`, `CVE-2025-64131` · Maven `org.jenkins-ci.plugins:saml`: affected `<4.583.585.v22ccc1139f55`, fixed in `4.583.585.v22ccc1139f55` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2025 · Tags: Authentication bypass
- [Jenkins Nexus Task Runner Plugin is missing a permission check](https://agentprime.io/advisories/GHSA-h83r-7f9f-mqjj.md)
  `GHSA-h83r-7f9f-mqjj`, `CVE-2025-64142` · Maven `org.jenkins-ci.plugins:nexus-task-runner`: affected `<=0.9.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Broken access control
- [Jenkins Themis Plugin vulnerable to cross-site request forgery](https://agentprime.io/advisories/GHSA-93mh-mx9w-m69q.md)
  `GHSA-93mh-mx9w-m69q`, `CVE-2025-64136` · Maven `org.jenkins-ci.plugins:themis`: affected `<=1.4.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery](https://agentprime.io/advisories/GHSA-6mgr-3374-4p3c.md)
  `GHSA-6mgr-3374-4p3c`, `CVE-2025-64138` · Maven `org.jenkins-ci.plugins:windocks-start-container`: affected `<=1.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files](https://agentprime.io/advisories/GHSA-4653-9q2r-684q.md)
  `GHSA-4653-9q2r-684q`, `CVE-2025-64143` · Maven `com.openshift.jenkins:openshift-pipeline`: affected `<=1.0.57`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Weak cryptography or TLS
- [Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery](https://agentprime.io/advisories/GHSA-3jw2-5hjg-hc2c.md)
  `GHSA-3jw2-5hjg-hc2c`, `CVE-2025-64133` · Maven `jp.ikedam.jenkins.plugins:extensible-choice-parameter`: affected `<=239.v5f5c278708cf`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files](https://agentprime.io/advisories/GHSA-2vmr-8c82-x8xq.md)
  `GHSA-2vmr-8c82-x8xq`, `CVE-2025-64144` · Maven `io.jenkins.plugins:byteguard-build-actions`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Weak cryptography or TLS
- [Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files](https://agentprime.io/advisories/GHSA-23vj-j6jc-w892.md)
  `GHSA-23vj-j6jc-w892`, `CVE-2025-64146` · Maven `org.jenkins-ci.plugins:curseforge-publisher`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Weak cryptography or TLS
- [InventoryGui allows item duplication in GUIs which use GuiStorageElement](https://agentprime.io/advisories/GHSA-7whh-79j3-7c55.md)
  `GHSA-7whh-79j3-7c55`, `CVE-2025-62784` · Maven `de.themoep:inventorygui`: affected `<1.6.5`, fixed in `1.6.5` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: CWE-837
- [Keycloak vulnerable to session takeovers due to reuse of session identifiers](https://agentprime.io/advisories/GHSA-rg35-5v25-mqvp.md)
  `GHSA-rg35-5v25-mqvp`, `CVE-2025-12390` · Maven `org.keycloak:keycloak-services`: affected `<26.0.0`, fixed in `26.0.0` · CVSS 6.0 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: Authentication bypass
- [Duplicate Advisory: Keycloak allows access to admin path through flaw](https://agentprime.io/advisories/GHSA-c6cm-5gc7-c3f4.md)
  `GHSA-c6cm-5gc7-c3f4` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<=26.4.2`, no fixed version yet · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 28 Oct 2025 · Tags: CWE-427
- [Liferay Portal Vulnerable to DoS via Crafted Headless API Request](https://agentprime.io/advisories/GHSA-vgqx-447m-wvcj.md)
  `GHSA-vgqx-447m-wvcj`, `CVE-2025-62260` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.100`, fixed in `7.4.3.100` · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2025 · Tags: Denial of service
- [Liferay Portal Does Not Limit Access to APIs Before Email Verification](https://agentprime.io/advisories/GHSA-gv7w-jh8g-vr73.md)
  `GHSA-gv7w-jh8g-vr73`, `CVE-2025-62259` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.110`, fixed in `7.4.3.110` · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: Broken access control
- [Liferay Portal Vulnerable to CSRF in Headless APIs](https://agentprime.io/advisories/GHSA-gh4w-8qgq-8w9r.md)
  `GHSA-gh4w-8qgq-8w9r`, `CVE-2025-62258` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.108`, fixed in `7.4.3.108` · CVSS 7.0 High · Not analysed yet · Published 28 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Liferay Portal Stores Password Reset Tokens in Plain Text](https://agentprime.io/advisories/GHSA-xcj6-xpjg-c4xr.md)
  `GHSA-xcj6-xpjg-c4xr`, `CVE-2025-62261` · Maven `com.liferay.portal:com.liferay.portal.impl` and 1 more: affected `<92.0.2`, fixed in `92.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: Information disclosure
- [Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature](https://agentprime.io/advisories/GHSA-cw79-fq4f-9r96.md)
  `GHSA-cw79-fq4f-9r96`, `CVE-2025-62262` · Maven `com.liferay:com.liferay.portal.security.ldap.impl`: affected `>=4.0.2, <4.0.54`, fixed in `4.0.54` · CVSS 4.6 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Information disclosure
- [Liferay Portal Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-8mgf-rgg5-w38q.md)
  `GHSA-8mgf-rgg5-w38q`, `CVE-2025-62263` · Maven `com.liferay:com.liferay.account.admin.web`: affected `>=2.0.0, <2.0.108`, fixed in `2.0.108` · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Open Redirect via the \_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter](https://agentprime.io/advisories/GHSA-2pwh-9q9q-5r9c.md)
  `GHSA-2pwh-9q9q-5r9c`, `CVE-2025-62253` · Maven `com.liferay:com.liferay.layout.admin.web`: affected `>=5.0.8, <5.0.157`, fixed in `5.0.157` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Open redirect
- [Keycloak TLS Client-Initiated Renegotiation Denial of Service](https://agentprime.io/advisories/GHSA-q8hq-4h99-fj7x.md)
  `GHSA-q8hq-4h99-fj7x`, `CVE-2025-11419` · Maven `org.keycloak:keycloak-quarkus-dist`: affected `<26.0.16 || >=26.1.0, <26.2.10 || >=26.3.0, <26.4.1`, fixed in `26.0.16`, `26.2.10`, `26.4.1` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: Denial of service
- [InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement](https://agentprime.io/advisories/GHSA-rgvh-4m82-fvjq.md)
  `GHSA-rgvh-4m82-fvjq`, `CVE-2025-62782` · Maven `de.themoep:inventorygui`: affected `<1.6.4-SNAPSHOT`, fixed in `1.6.4-SNAPSHOT` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-837
- [InventoryGui affected by item duplication in GUIs which use GuiStorageElement](https://agentprime.io/advisories/GHSA-598q-jw82-5w66.md)
  `GHSA-598q-jw82-5w66`, `CVE-2025-62783` · Maven `de.themoep:inventorygui`: affected `<1.6.2-SNAPSHOT`, fixed in `1.6.2-SNAPSHOT` · CVSS 5.0 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-754, CWE-837
- [Apache Tomcat Vulnerable to Relative Path Traversal](https://agentprime.io/advisories/GHSA-wmwf-9ccg-fff5.md)
  `GHSA-wmwf-9ccg-fff5`, `BIT-tomcat-2025-55752`, `CVE-2025-55752` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.0-M11, <9.0.109 || >=8.5.6, <=8.5.100`, fixed in `11.0.11`, `10.1.45`, `9.0.109` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.64 · Not analysed yet · Published 27 Oct 2025 · Tags: Path traversal
- [Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences](https://agentprime.io/advisories/GHSA-vfww-5hm6-hx2j.md)
  `GHSA-vfww-5hm6-hx2j`, `BIT-tomcat-2025-55754`, `CVE-2025-55754` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.11 || >=10.1.0-M1, <10.1.45 || >=9.0.40, <9.0.109 || >=8.5.60, <=8.5.100`, fixed in `11.0.11`, `10.1.45`, `9.0.109` · CVSS 9.6 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-150
- [Apache Tomcat Vulnerable to Improper Resource Shutdown or Release](https://agentprime.io/advisories/GHSA-hgrr-935x-pq79.md)
  `GHSA-hgrr-935x-pq79`, `BIT-tomcat-2025-61795`, `CVE-2025-61795` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.12 || >=10.1.0-M1, <10.1.47 || >=9.0.0.M1, <9.0.110 || >=8.5.0, <=8.5.100`, fixed in `11.0.12`, `10.1.47`, `9.0.110` · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Denial of service
- [Bouncy Castle Vulnerable to Uncontrolled Resource Consumption](https://agentprime.io/advisories/GHSA-jv6h-4262-q663.md)
  `GHSA-jv6h-4262-q663`, `CVE-2025-12194` · Maven `org.bouncycastle:bc-fips` and 1 more: affected `>=2.1.0, <2.1.2`, fixed in `2.1.2` · CVSS 5.9 Medium · Not analysed yet · Published 25 Oct 2025 · Tags: Denial of service
- [Liferay Portal ComboServlet denial of service via large file combination](https://agentprime.io/advisories/GHSA-q95h-87j6-273x.md)
  `GHSA-q95h-87j6-273x`, `CVE-2025-62254` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<97.0.0`, fixed in `97.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Path traversal
- [MCMS reflected cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-wvv5-5g6x-hp7j.md)
  `GHSA-wvv5-5g6x-hp7j`, `CVE-2025-60837` · Maven `net.mingsoft:ms-mcms`: affected `<=6.0.1`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page](https://agentprime.io/advisories/GHSA-gccf-r9xp-x8jx.md)
  `GHSA-gccf-r9xp-x8jx`, `CVE-2025-62255` · Maven `com.liferay:com.liferay.knowledge.base.web`: affected `<5.0.109`, fixed in `5.0.109` · CVSS 2.0 Low · Not analysed yet · Published 23 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal and DXP do not properly restrict access to OpenAPI](https://agentprime.io/advisories/GHSA-j82q-c85j-xw4w.md)
  `GHSA-j82q-c85j-xw4w`, `CVE-2025-62256` · Maven `com.liferay:com.liferay.portal.security.auth.verifier`: affected `<6.0.26`, fixed in `6.0.26` · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Broken access control
- [Keycloak does not invalidate offline sessions when the offline_access scope is removed](https://agentprime.io/advisories/GHSA-895x-rfqp-jh5c.md)
  `GHSA-895x-rfqp-jh5c`, `CVE-2025-12110` · Maven `org.keycloak:keycloak-services`: affected `<26.2.3`, fixed in `26.2.3` · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Authentication bypass
- [Keycloak does not invalidate sessions when "Remember Me" is disabled](https://agentprime.io/advisories/GHSA-64w3-5q9m-68xf.md)
  `GHSA-64w3-5q9m-68xf`, `CVE-2025-11429` · Maven `org.keycloak:keycloak-services`: affected `>=26.3.0, <26.4.1 || <26.2.11`, fixed in `26.4.1`, `26.2.11` · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Authentication bypass
- [Liferay Portal and DXP are Missing Authorization in Collection Provider](https://agentprime.io/advisories/GHSA-cqwv-9xh5-25fg.md)
  `GHSA-cqwv-9xh5-25fg`, `CVE-2025-62247` · Maven `com.liferay:com.liferay.search.experiences.service`: affected `<=3.0.84`, no fixed version yet · CVSS 2.0 Low · Not analysed yet · Published 22 Oct 2025 · Tags: Broken access control
- [Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)](https://agentprime.io/advisories/GHSA-phjr-p9c5-hprx.md)
  `GHSA-phjr-p9c5-hprx`, `CVE-2025-62248` · Maven `com.liferay:com.liferay.dynamic.data.mapping.web`: affected `<=5.0.122`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl](https://agentprime.io/advisories/GHSA-gr7h-xw4f-wh86.md)
  `GHSA-gr7h-xw4f-wh86`, `CVE-2025-62710` · Maven `org.sakaiproject.kernel:sakai-kernel-impl`: affected `<=23.3`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-337
- [Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names](https://agentprime.io/advisories/GHSA-45p5-v273-3qqr.md)
  `GHSA-45p5-v273-3qqr`, `CVE-2025-11966` · Maven `io.vertx:vertx-web`: affected `<4.5.22 || >=5.0.0, <5.0.5`, fixed in `4.5.22`, `5.0.5` · CVSS 2.3 Low · Not analysed yet · Published 22 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories](https://agentprime.io/advisories/GHSA-h5fg-jpgr-rv9c.md)
  `GHSA-h5fg-jpgr-rv9c`, `CVE-2025-11965` · Maven `io.vertx:vertx-web`: affected `<4.5.22 || >=5.0.0, <5.0.5`, fixed in `4.5.22`, `5.0.5` · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Information disclosure
- [Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget](https://agentprime.io/advisories/GHSA-rx48-gqc2-4w47.md)
  `GHSA-rx48-gqc2-4w47`, `CVE-2025-62249` · Maven `com.liferay.portal:com.liferay.portal.impl`: affected `<=114.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal fails to verify messages from the cluster network is trusted](https://agentprime.io/advisories/GHSA-6pgj-w687-9c8c.md)
  `GHSA-6pgj-w687-9c8c`, `CVE-2025-62250` · Maven `com.liferay:com.liferay.portal.cluster.multiple`: affected `<5.0.35`, fixed in `5.0.35` · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: CWE-346
- [Apache Syncope allows malicious administrators to inject Groovy code](https://agentprime.io/advisories/GHSA-825g-mm5v-ggq4.md)
  `GHSA-825g-mm5v-ggq4`, `CVE-2025-57738` · Maven `org.apache.syncope.core:syncope-core-spring`: affected `<3.0.14 || >=4.0.0-M0, <4.0.2`, fixed in `3.0.14`, `4.0.2` · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 20 Oct 2025 · Tags: CWE-653
- [Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system](https://agentprime.io/advisories/GHSA-gjp8-99fv-cgcw.md)
  `GHSA-gjp8-99fv-cgcw`, `CVE-2025-47410` · Maven `org.apache.geode:geode-web`: affected `>=1.10.0, <1.15.2`, fixed in `1.15.2` · CVSS 8.8 High · Not analysed yet · Published 18 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [MCMS vulnerable SQL injection via the content_title parameter](https://agentprime.io/advisories/GHSA-54wc-49qj-5ghj.md)
  `GHSA-54wc-49qj-5ghj`, `CVE-2025-56316` · Maven `net.mingsoft:ms-mcms`: affected `>=5.5.0, <6.0.2`, fixed in `6.0.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2025 · Tags: SQL injection
- [ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature](https://agentprime.io/advisories/GHSA-fpq4-r87v-g246.md)
  `GHSA-fpq4-r87v-g246`, `CVE-2025-34281` · Maven `org.thingsboard:application`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 6.2 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Keycloak error_description injection on error pages that can trigger phishing attacks](https://agentprime.io/advisories/GHSA-27gc-wj6x-9w55.md)
  `GHSA-27gc-wj6x-9w55`, `CVE-2025-10044` · Maven `org.keycloak:keycloak-account-ui` and 1 more: affected `<26.2.9 || >=26.3.0, <26.3.4`, fixed in `26.2.9`, `26.3.4` · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Mammoth is vulnerable to Directory Traversal](https://agentprime.io/advisories/GHSA-rmjr-87wv-gf87.md)
  `GHSA-rmjr-87wv-gf87`, `CVE-2025-11849`, `PYSEC-2026-1603` · Maven `org.zwobble.mammoth:mammoth` and 3 more: affected `<1.11.0`, fixed in `1.11.0` · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Path traversal
- [Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection](https://agentprime.io/advisories/GHSA-fwxx-wv44-7qfg.md)
  `GHSA-fwxx-wv44-7qfg`, `CVE-2025-41253` · Maven `org.springframework.cloud:spring-cloud-gateway-server`: affected `>=4.3.0, <4.3.2 || >=4.2.0, <4.2.6 || >=4.0.0, <=4.1.9 || <=3.1.10`, fixed in `4.3.2`, `4.2.6` · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2025 · Tags: Code injection
- [Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages](https://agentprime.io/advisories/GHSA-7fch-4f2f-jcgm.md)
  `GHSA-7fch-4f2f-jcgm`, `CVE-2025-41254` · Maven `org.springframework:spring-websocket`: affected `>=6.2.0, <6.2.12 || >=6.1.0, <=6.1.21 || >=6.0.0, <=6.0.23 || <=5.3.39`, fixed in `6.2.12` · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTEwLTE2VDE1OjMwOjQzLjAwMDAwMFoiLCJHSFNBLTdmY2gtNGYyZi1qY2dtIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTEwLTMwVDIxOjMwOjQ2LjAwMDAwMFoiLCJHSFNBLTU2anYtNHd3My02NW13Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTEwLTMwVDIxOjMwOjQ2LjAwMDAwMFoiLCJHSFNBLTU2anYtNHd3My02NW13Il0>. Everything for agents: <https://agentprime.io/llms.txt>.