# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Jenkins is missing a permission check on password fields](https://agentprime.io/advisories/GHSA-p3f5-98cv-562j.md)
  `GHSA-p3f5-98cv-562j`, `BIT-jenkins-2025-67636`, `CVE-2025-67636` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Broken access control
- [Jenkins's build authorization token is stored and displayed in plain text](https://agentprime.io/advisories/GHSA-hxjg-2jvf-h3rx.md)
  `GHSA-hxjg-2jvf-h3rx`, `BIT-jenkins-2025-67638`, `CVE-2025-67638` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Information disclosure
- [Jenkins's build authorization token is stored and displayed in plain text](https://agentprime.io/advisories/GHSA-fxj7-6v9w-xc76.md)
  `GHSA-fxj7-6v9w-xc76`, `BIT-jenkins-2025-67637`, `CVE-2025-67637` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Information disclosure
- [Jenkins has a Denial of service vulnerability in HTTP-based CLI](https://agentprime.io/advisories/GHSA-9p56-p6mw-w8qc.md)
  `GHSA-9p56-p6mw-w8qc`, `BIT-jenkins-2025-67635`, `CVE-2025-67635` · Maven `org.jenkins-ci.main:cli` and 1 more: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 7.5 High · Not analysed yet · Published 10 Dec 2025 · Tags: Denial of service
- [Jenkins has a CSRF vulnerability on the login form](https://agentprime.io/advisories/GHSA-6837-qgrc-x5p6.md)
  `GHSA-6837-qgrc-x5p6`, `BIT-jenkins-2025-67639`, `CVE-2025-67639` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.529, <2.541 || <2.528.3`, fixed in `2.541`, `2.528.3` · CVSS 3.5 Low · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site request forgery (CSRF)
- [XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection](https://agentprime.io/advisories/GHSA-9xc6-c2rm-f27p.md)
  `GHSA-9xc6-c2rm-f27p`, `CVE-2025-66474` · Maven `org.xwiki.rendering:xwiki-rendering-xml`: affected `<16.10.10 || >=17.0.0-rc-1, <17.4.3 || >=17.5.0-rc-1, <17.6.0-rc-1`, fixed in `16.10.10`, `17.4.3`, `17.6.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis](https://agentprime.io/advisories/GHSA-cc84-q3v3-mhgf.md)
  `GHSA-cc84-q3v3-mhgf`, `CVE-2025-66473` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `<16.10.11 || >=17.0.0-rc-1, <17.4.4 || >=17.5.0-rc-1, <17.7.0-rc-1`, fixed in `16.10.11`, `17.4.4`, `17.7.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Denial of service
- [XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication](https://agentprime.io/advisories/GHSA-7vpr-jm38-wr7w.md)
  `GHSA-7vpr-jm38-wr7w`, `CVE-2025-66472` · Maven `org.xwiki.platform:xwiki-platform-flamingo-skin-resources` and 1 more: affected `>=6.2-milestone-1, <16.10.10 || >=17.0.0-rc-1, <17.4.2`, fixed in `16.10.10`, `17.4.2` · CVSS 6.5 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Apache Struts has a Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-rg58-xhh7-mqjw.md)
  `GHSA-rg58-xhh7-mqjw`, `CVE-2025-66675` · Maven `org.apache.struts:struts2-core`: affected `>=2.0.0, <6.8.0 || >=7.0.0, <7.1.1`, fixed in `6.8.0`, `7.1.1` · CVSS 8.2 High · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-459
- [Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions](https://agentprime.io/advisories/GHSA-6q37-7866-h27j.md)
  `GHSA-6q37-7866-h27j`, `CVE-2025-14082` · Maven `org.keycloak:keycloak-services`: affected `<26.5.0`, fixed in `26.5.0` · CVSS 2.7 Low · Not analysed yet · Published 10 Dec 2025 · Tags: Broken access control
- [Robocode vulnerable to Directory Traversal in recursivelyDelete Method](https://agentprime.io/advisories/GHSA-j8r2-47rx-qhw4.md)
  `GHSA-j8r2-47rx-qhw4`, `CVE-2025-14306` · Maven `net.sf.robocode:robocode.core`: affected `<1.9.5.6`, fixed in `1.9.5.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Path traversal
- [Robocode has an insecure temporary file creation vulnerability in the AutoExtract component](https://agentprime.io/advisories/GHSA-2mxr-rc97-xrj2.md)
  `GHSA-2mxr-rc97-xrj2`, `CVE-2025-14307` · Maven `net.sf.robocode:robocode.battle`: affected `<1.9.5.6`, fixed in `1.9.5.6` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-377
- [JDA (Java Discord API) downloads external URLs when updating message components](https://agentprime.io/advisories/GHSA-93fv-4pm9-xp28.md)
  `GHSA-93fv-4pm9-xp28` · Maven `net.dv8tion:JDA`: affected `>=6.0.0, <6.1.3`, fixed in `6.1.3` · CVSS 4.0, no score published · Not analysed yet · Published 9 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands](https://agentprime.io/advisories/GHSA-xrhh-hx36-485q.md)
  `GHSA-xrhh-hx36-485q`, `CVE-2025-66623` · Maven `io.strimzi:strimzi`: affected `>=0.47.0, <0.49.1`, fixed in `0.49.1` · CVSS 7.4 High · Not analysed yet · Published 5 Dec 2025 · Tags: Information disclosure, Broken access control
- [yawkat LZ4 Java has a possible information leak in Java safe decompressor](https://agentprime.io/advisories/GHSA-cmp6-m4wj-q63q.md)
  `GHSA-cmp6-m4wj-q63q`, `CVE-2025-66566` · Maven `at.yawk.lz4:lz4-java` and 3 more: affected `<1.10.1`, fixed in `1.10.1` · CVSS 8.2 High · Not analysed yet · Published 5 Dec 2025 · Tags: Information disclosure
- [Apache Tika has XXE vulnerability](https://agentprime.io/advisories/GHSA-f58c-gq56-vjjf.md)
  `GHSA-f58c-gq56-vjjf`, `CVE-2025-66516` · Maven `org.apache.tika:tika-core` and 2 more: affected `>=1.13, <3.2.2`, fixed in `3.2.2` · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 4 Dec 2025 · Tags: XML external entities (XXE)
- [Central Dogma's Login Function Has an Open Redirect Vulnerability](https://agentprime.io/advisories/GHSA-4hr2-xf7w-jf76.md)
  `GHSA-4hr2-xf7w-jf76`, `CVE-2025-11222` · Maven `com.linecorp.centraldogma:centraldogma-server-auth-shiro`: affected `<0.78.0`, fixed in `0.78.0` · CVSS 6.1 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Open redirect
- [Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded](https://agentprime.io/advisories/GHSA-6h4f-pj3g-q8fq.md)
  `GHSA-6h4f-pj3g-q8fq`, `CVE-2024-3884` · Maven `io.undertow:undertow-core`: affected `<2.2.39.Final || >=2.4.0.Alpha1, <2.4.0.Beta1 || >=2.3.0.Alpha1, <2.3.21.Final`, fixed in `2.2.39.Final`, `2.4.0.Beta1`, `2.3.21.Final` · CVSS 7.5 High · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-20
- [Rhino has high CPU usage and potential DoS when passing specific numbers to \`toFixed()\` function](https://agentprime.io/advisories/GHSA-3w8q-xq97-5j7x.md)
  `GHSA-3w8q-xq97-5j7x`, `CVE-2025-66453` · Maven `org.mozilla:rhino`: affected `<1.7.14.1 || >=1.7.15, <1.7.15.1 || >=1.8.0, <1.8.1`, fixed in `1.7.14.1`, `1.7.15.1`, `1.8.1` · CVSS 5.5 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Denial of service
- [BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources](https://agentprime.io/advisories/GHSA-fxp5-37mh-vff5.md)
  `GHSA-fxp5-37mh-vff5`, `CVE-2025-13472` · Maven `com.blazemeter.plugins:BlazeMeterJenkinsPlugin`: affected `<4.27`, fixed in `4.27` · CVSS 5.3 Medium · Not analysed yet · Published 3 Dec 2025 · Tags: Broken access control
- [Keycloak unable to restrict access to the admin console](https://agentprime.io/advisories/GHSA-vjr8-56p3-fmqq.md)
  `GHSA-vjr8-56p3-fmqq`, `CVE-2025-10939` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<26.4.4`, fixed in `26.4.4` · CVSS 3.7 Low · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-427
- [Keycloak has debug default bind address](https://agentprime.io/advisories/GHSA-j4vq-q93m-4683.md)
  `GHSA-j4vq-q93m-4683`, `CVE-2025-11538` · Maven `org.keycloak:keycloak-quarkus-dist`: affected `<26.4.4`, fixed in `26.4.4` · CVSS 6.8 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-1327
- [Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls](https://agentprime.io/advisories/GHSA-rcmh-qjqh-p98v.md)
  `GHSA-rcmh-qjqh-p98v`, `CVE-2025-14874` · Maven `org.webjars.npm:nodemailer` and 1 more: affected `>=3.0.0, <=6.10.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-703
- [XWiki Jetty Package (XJetty) allows accessing any application file through URL](https://agentprime.io/advisories/GHSA-53gx-j3p6-2rw9.md)
  `GHSA-53gx-j3p6-2rw9`, `CVE-2025-55749` · Maven `org.xwiki.platform:xwiki-platform-tool-jetty-resources`: affected `>=16.7.0, <16.10.11 || >=17.0.0-rc-1, <17.4.4 || >=17.5.0, <17.7.0`, fixed in `16.10.11`, `17.4.4`, `17.7.0` · CVSS 8.7 High · Not analysed yet · Published 1 Dec 2025 · Tags: Broken access control
- [Apache Struts is Vulnerable to DoS via File Leak](https://agentprime.io/advisories/GHSA-xx7v-hqxh-cjr9.md)
  `GHSA-xx7v-hqxh-cjr9`, `CVE-2025-64775` · Maven `org.apache.struts:struts2-core`: affected `>=6.0.0, <6.8.0 || >=7.0.0, <7.1.1 || >=2.0.0, <=2.3.37 || >=2.5.0, <=2.5.33`, fixed in `6.8.0`, `7.1.1` · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-459
- [NutzBoot vulnerable to information disclosure](https://agentprime.io/advisories/GHSA-qp56-qj59-hjf8.md)
  `GHSA-qp56-qj59-hjf8`, `CVE-2025-13804` · Maven `org.nutz:nutzboot-parent`: affected `<=2.6.0-SNAPSHOT`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Information disclosure, Broken access control
- [NutzBoot vulnerable to deserialization](https://agentprime.io/advisories/GHSA-fgmj-6h3v-4q56.md)
  `GHSA-fgmj-6h3v-4q56`, `CVE-2025-13805` · Maven `org.nutz:nutzboot-parent`: affected `<=2.6.0-SNAPSHOT`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Insecure deserialization, CWE-20
- [NutzBoot Incorrect Privilege Assignment vulnerability](https://agentprime.io/advisories/GHSA-53v5-9752-qq92.md)
  `GHSA-53v5-9752-qq92`, `CVE-2025-13806` · Maven `org.nutz:nutzboot-parent`: affected `<=2.6.0-SNAPSHOT`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Privilege escalation, Broken access control
- [LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS](https://agentprime.io/advisories/GHSA-vqf4-7m7x-wgfc.md)
  `GHSA-vqf4-7m7x-wgfc`, `CVE-2025-12183` · Maven `at.yawk.lz4:lz4-java` and 3 more: affected `<1.8.1`, fixed in `1.8.1` · CVSS 8.8 High · Not analysed yet · Published 28 Nov 2025 · Tags: Memory corruption
- [Mustangproject allows exfiltrating files via XXE attacks](https://agentprime.io/advisories/GHSA-x832-fpvj-r5ph.md)
  `GHSA-x832-fpvj-r5ph`, `CVE-2025-66372` · Maven `org.mustangproject:library` and 1 more: affected `<2.16.3`, fixed in `2.16.3` · CVSS 2.8 Low · Not analysed yet · Published 28 Nov 2025 · Tags: XML external entities (XXE)
- [ThingsBoard allows an authenticated user to upload malicious SVG images](https://agentprime.io/advisories/GHSA-5p82-2q3r-wj3m.md)
  `GHSA-5p82-2q3r-wj3m`, `CVE-2025-3261` · Maven `org.thingsboard:application`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 4.0, no score published · Not analysed yet · Published 27 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Apache SkyWalking has a stored XSS vulnerability](https://agentprime.io/advisories/GHSA-v6x2-4q87-rf82.md)
  `GHSA-v6x2-4q87-rf82`, `CVE-2025-54057` · Maven `org.apache.skywalking:apm-webapp`: affected `<=10.1.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Hive Metastore Server is vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-932v-x9x2-vq29.md)
  `GHSA-932v-x9x2-vq29`, `CVE-2025-62728` · Maven `org.apache.hive:hive-common` and 1 more: affected `>=4.1.0, <4.2.0`, fixed in `4.2.0` · CVSS 5.4 Medium · Not analysed yet · Published 26 Nov 2025 · Tags: SQL injection
- [Apache Druid’s Kerberos authenticator uses a weak fallback secret](https://agentprime.io/advisories/GHSA-w88f-4875-99c8.md)
  `GHSA-w88f-4875-99c8`, `CVE-2025-59390` · Maven `org.apache.druid:druid`: affected `<35.0.0`, fixed in `35.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2025 · Tags: Weak cryptography or TLS
- [OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization](https://agentprime.io/advisories/GHSA-g9gq-3pfx-2gw2.md)
  `GHSA-g9gq-3pfx-2gw2`, `CVE-2025-66021` · Maven `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer`: affected `>=20240325.1, <20260101.1`, fixed in `20260101.1` · CVSS 8.6 High · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site scripting (XSS)
- [OpenSearch is vulnerable to DoS via complex query_string inputs](https://agentprime.io/advisories/GHSA-mw3v-mmfw-3x2g.md)
  `GHSA-mw3v-mmfw-3x2g`, `CVE-2025-9624` · Maven `org.opensearch:opensearch-common`: affected `>=3.0.0, <3.3.0 || <2.19.4`, fixed in `3.3.0`, `2.19.4` · CVSS 8.3 High · Not analysed yet · Published 25 Nov 2025 · Tags: Denial of service
- [GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature](https://agentprime.io/advisories/GHSA-fjf5-xgmq-5525.md)
  `GHSA-fjf5-xgmq-5525`, `CVE-2025-58360` · Maven `org.geoserver:gs-wms` and 1 more: affected `>=2.26.0, <2.26.2 || <2.25.6`, fixed in `2.26.2`, `2.25.6` · CVSS 8.2 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.61 · Not analysed yet · Published 25 Nov 2025 · Tags: XML external entities (XXE)
- [GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format](https://agentprime.io/advisories/GHSA-w66h-j855-qr72.md)
  `GHSA-w66h-j855-qr72`, `CVE-2025-21621` · Maven `org.geoserver:gs-wms` and 1 more: affected `<2.25.0`, fixed in `2.25.0` · CVSS 6.1 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization](https://agentprime.io/advisories/GHSA-93vm-mqpw-8wh3.md)
  `GHSA-93vm-mqpw-8wh3` · Maven `org.keycloak:keycloak-ldap-federation`: affected `<26.4.6`, fixed in `26.4.6` · CVSS 5.5 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2025 · Tags: Insecure deserialization
- [Apache Syncope's AES encryption stores hard-coded passwords in internal database](https://agentprime.io/advisories/GHSA-jqg8-m35q-jh7j.md)
  `GHSA-jqg8-m35q-jh7j`, `CVE-2025-65998` · Maven `org.apache.syncope:syncope-core`: affected `>=4.0.0, <4.0.3 || <3.0.15`, fixed in `4.0.3`, `3.0.15` · CVSS 7.5 High · Not analysed yet · Published 24 Nov 2025 · Tags: Hard-coded credentials
- [Resty has a Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-cv3m-hxpc-4hvm.md)
  `GHSA-cv3m-hxpc-4hvm`, `CVE-2025-13435` · Maven `cn.dreampie:resty`: affected `<=1.3.1.SNAPSHOT`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Path traversal
- [Apache Causeway vulnerable to deserialization in Java](https://agentprime.io/advisories/GHSA-wq4c-57mh-5f7g.md)
  `GHSA-wq4c-57mh-5f7g`, `CVE-2025-64408` · Maven `org.apache.causeway.commons:causeway-commons` and 3 more: affected `<3.5.0`, fixed in `3.5.0` · CVSS 6.3 Medium · EPSS 0.12 · Not analysed yet · Published 19 Nov 2025 · Tags: Insecure deserialization
- [XWiki view file macro: User can view content of office file without view rights on the attachment](https://agentprime.io/advisories/GHSA-8c52-x9w7-vc95.md)
  `GHSA-8c52-x9w7-vc95`, `CVE-2025-65089` · Maven `com.xwiki.pro:xwiki-pro-macros-ui`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 6.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Broken access control
- [Eclipse Jersey has a Race Condition](https://agentprime.io/advisories/GHSA-7p63-w6x9-6gr7.md)
  `GHSA-7p63-w6x9-6gr7`, `CVE-2025-12383` · Maven `org.glassfish.jersey.core:jersey-client`: affected `>=2.45, <2.46 || >=3.0.16, <3.0.17 || >=3.1.9, <3.1.10`, fixed in `2.46`, `3.0.17`, `3.1.10` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: Race condition, CWE-296
- [XWiki AdminTools application doesn't set permissions on the AdminTools space](https://agentprime.io/advisories/GHSA-v7r8-8p5c-h4xw.md)
  `GHSA-v7r8-8p5c-h4xw`, `CVE-2025-54990` · Maven `com.xwiki.admintools:application-admintools`: affected `<1.1`, fixed in `1.1` · CVSS 5.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Broken access control
- [lsFusion Platform has a Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-gwwr-j923-vq7r.md)
  `GHSA-gwwr-j923-vq7r`, `CVE-2025-13262` · Maven `lsfusion.platform:web-client`: affected `<=6.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal
- [vlife-base has Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-cg6m-9276-qpjj.md)
  `GHSA-cg6m-9276-qpjj`, `CVE-2025-13266` · Maven `io.github.wwwlike:vlife-base`: affected `<=2.0.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal
- [lsFusion Server is vulnerable to Path Traversal through its unpackFile function](https://agentprime.io/advisories/GHSA-8wf8-frjg-xv74.md)
  `GHSA-8wf8-frjg-xv74`, `CVE-2025-13265` · Maven `lsfusion.platform:server`: affected `<=6.0-beta2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal
- [lsFusion Platform has a Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-5jpg-2rj5-964c.md)
  `GHSA-5jpg-2rj5-964c`, `CVE-2025-13261` · Maven `lsfusion.platform:web-client`: affected `<=6.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Path traversal
- [Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-7xw4-g7mm-r4hh.md)
  `GHSA-7xw4-g7mm-r4hh` · Maven `software.amazon.jdbc:aws-advanced-jdbc-wrapper`: affected `<2.6.5`, fixed in `2.6.5` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection
- [Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address](https://agentprime.io/advisories/GHSA-7m9g-pmxf-m9m8.md)
  `GHSA-7m9g-pmxf-m9m8` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<=26.4.4`, no fixed version yet · CVSS 6.8 Medium · Withdrawn · Not analysed yet · Published 13 Nov 2025 · Tags: CWE-1327
- [OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed](https://agentprime.io/advisories/GHSA-39hr-239p-fhqc.md)
  `GHSA-39hr-239p-fhqc`, `CVE-2025-64099` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<16.0.3`, fixed in `16.0.3` · CVSS 8.1 High · Not analysed yet · Published 12 Nov 2025 · Tags: Other injection, Code injection
- [CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection](https://agentprime.io/advisories/GHSA-6fhj-vr9j-g45r.md)
  `GHSA-6fhj-vr9j-g45r`, `CVE-2025-64518` · Maven `org.cyclonedx:cyclonedx-core-java`: affected `>=2.1.0, <11.0.1`, fixed in `11.0.1` · CVSS 7.5 High · Not analysed yet · Published 10 Nov 2025 · Tags: XML external entities (XXE)
- [WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks](https://agentprime.io/advisories/GHSA-fvfq-q238-j7j3.md)
  `GHSA-fvfq-q238-j7j3`, `CVE-2025-10713` · Maven `org.wso2.carbon.mediation:org.wso2.carbon.localentry`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: XML external entities (XXE)
- [Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH](https://agentprime.io/advisories/GHSA-j2pc-v64r-mv4f.md)
  `GHSA-j2pc-v64r-mv4f` · Maven `io.github.ascopes:protobuf-maven-plugin`: affected `>=4.0.0, <4.0.2 || <3.10.2`, fixed in `4.0.2`, `3.10.2` · CVSS 4.0, no score published · Not analysed yet · Published 4 Nov 2025 · Tags: CWE-354, CWE-693
- [Liferay Portal and DXP do not check permissions of images in a blog entry](https://agentprime.io/advisories/GHSA-xf7m-v66q-76w8.md)
  `GHSA-xf7m-v66q-76w8`, `CVE-2025-62275` · Maven `com.liferay:com.liferay.blogs.item.selector.web`: affected `<6.0.19`, fixed in `6.0.19` · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2025 · Tags: Broken access control
- [Liferay Portal and DXP use an incorrect cache-control header](https://agentprime.io/advisories/GHSA-6533-fhr2-f38h.md)
  `GHSA-6533-fhr2-f38h`, `CVE-2025-62276` · Maven `com.liferay:com.liferay.adaptive.media.web` and 1 more: affected `<5.0.52`, fixed in `5.0.52` · CVSS 4.6 Medium · Not analysed yet · Published 1 Nov 2025 · Tags: CWE-525
- [Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page](https://agentprime.io/advisories/GHSA-q285-wfpg-93hr.md)
  `GHSA-q285-wfpg-93hr`, `CVE-2025-62267` · Maven `com.liferay:com.liferay.dynamic.data.mapping.item.selector.web`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 4.6 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter](https://agentprime.io/advisories/GHSA-2j97-4jmq-c4xf.md)
  `GHSA-2j97-4jmq-c4xf`, `CVE-2025-62264` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.3.8, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 5.1 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Liferay Portal is vulnerable to XSS in the Blogs widget](https://agentprime.io/advisories/GHSA-56jv-4ww3-65mw.md)
  `GHSA-56jv-4ww3-65mw`, `CVE-2025-62265` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0-ga1, <7.4.3.112-ga112`, fixed in `7.4.3.112-ga112` · CVSS 4.8 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTEwLTMwVDIxOjMwOjQ2LjAwMDAwMFoiLCJHSFNBLTU2anYtNHd3My02NW13Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI1LTEyLTEwVDE4OjMwOjI2LjAwMDAwMFoiLCJHSFNBLXY4aGctbTMyMy1qdmpxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI1LTEyLTEwVDE4OjMwOjI2LjAwMDAwMFoiLCJHSFNBLXY4aGctbTMyMy1qdmpxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.