# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata](https://agentprime.io/advisories/GHSA-f2hp-qw27-8wfq.md)
  `GHSA-f2hp-qw27-8wfq`, `CVE-2026-35565` · Maven `org.apache.storm:storm-webapp`: affected `<2.8.6`, fixed in `2.8.6` · CVSS 5.4 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression](https://agentprime.io/advisories/GHSA-822v-8w6h-5jxp.md)
  `GHSA-822v-8w6h-5jxp`, `CVE-2026-6125` · Maven `org.dromara.warm:warm-flow-plugin-modes-sb`: affected `<1.8.5`, fixed in `1.8.5` · CVSS 5.3 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: Other injection, Code injection
- [Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout](https://agentprime.io/advisories/GHSA-w35j-pv5h-q9q9.md)
  `GHSA-w35j-pv5h-q9q9`, `CVE-2026-34481` · Maven `org.apache.logging.log4j:log4j-layout-template-json`: affected `>=2.14.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-h383-gmxw-35v2.md)
  `GHSA-h383-gmxw-35v2`, `CVE-2026-34479` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.7, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta2`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache Log4j Core: \`verifyHostName\` attribute silently ignored in TLS configuration](https://agentprime.io/advisories/GHSA-6hg6-v5c8-fphq.md)
  `GHSA-6hg6-v5c8-fphq`, `CVE-2026-34477` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.12.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache Log4j Core: log injection in \`Rfc5424Layout\` due to silent configuration incompatibility](https://agentprime.io/advisories/GHSA-445c-vh5m-36rj.md)
  `GHSA-445c-vh5m-36rj`, `CVE-2026-34478` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.21.0, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Other injection, CWE-684
- [Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-3pxv-7cmr-fjr4.md)
  `GHSA-3pxv-7cmr-fjr4`, `CVE-2026-34480` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.0-alpha1, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3`, fixed in `2.25.4` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Apache ActiveMQ: Denial of Service via Out of Memory vulnerability](https://agentprime.io/advisories/GHSA-5568-6qcg-g7fx.md)
  `GHSA-5568-6qcg-g7fx`, `BIT-activemq-2026-39304`, `CVE-2026-39304` · Maven `org.apache.activemq:activemq-all` and 3 more: affected `<5.19.4 || >=6.0.0, <6.2.4`, fixed in `5.19.4`, `6.2.4` · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Denial of service
- [Spring Cloud Gateway's SSL bundle configuration silently bypassed](https://agentprime.io/advisories/GHSA-hwqh-2684-54fc.md)
  `GHSA-hwqh-2684-54fc`, `CVE-2026-22750` · Maven `org.springframework.cloud:spring-cloud-gateway`: affected `>=4.2.0, <4.2.1`, fixed in `4.2.1` · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-15
- [Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/GHSA-x4m4-345f-5h5g.md)
  `GHSA-x4m4-345f-5h5g`, `BIT-tomcat-2026-34487`, `CVE-2026-34487` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.13, <9.0.117 || >=10.1.0-M1, <10.1.54 || >=11.0.0-M1, <11.0.21`, fixed in `9.0.117`, `10.1.54`, `11.0.21` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Information disclosure
- [Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve](https://agentprime.io/advisories/GHSA-rv64-5gf8-9qq8.md)
  `GHSA-rv64-5gf8-9qq8`, `BIT-tomcat-2026-34483`, `CVE-2026-34483` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.40, <9.0.116 || >=10.1.0-M1, <10.1.54 || >=11.0.0-M1, <11.0.21`, fixed in `9.0.116`, `10.1.54`, `11.0.21` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-116
- [Apache Tomcat Missing Encryption of Sensitive Data vulnerability](https://agentprime.io/advisories/GHSA-69r9-qgr7-g2wj.md)
  `GHSA-69r9-qgr7-g2wj`, `BIT-tomcat-2026-34486`, `CVE-2026-34486` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117`, fixed in `11.0.21`, `10.1.54`, `9.0.117` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS, CWE-807
- [Apache Tomcat: CLIENT_CERT authentication does not fail as expected](https://agentprime.io/advisories/GHSA-24j9-x2wg-9qv6.md)
  `GHSA-24j9-x2wg-9qv6`, `BIT-tomcat-2026-34500`, `CVE-2026-34500` · Maven `org.apache.tomcat:tomcat-coyote-ffm`: affected `>=9.0.92, <9.0.117 || >=10.1.22, <10.1.54 || >=11.0.0-M14, <11.0.21`, fixed in `9.0.117`, `10.1.54`, `11.0.21` · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Authentication bypass
- [Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor](https://agentprime.io/advisories/GHSA-h468-7pvh-8vr8.md)
  `GHSA-h468-7pvh-8vr8`, `BIT-tomcat-2026-29146`, `CVE-2026-29146` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=9.0.13, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.0-M1, <11.0.20 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Information disclosure, CWE-642, CWE-1240
- [Apache Tomcat has an Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-9m3c-qcxr-9x87.md)
  `GHSA-9m3c-qcxr-9x87`, `BIT-tomcat-2026-25854`, `CVE-2026-25854` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=8.5.30, <9.0.116 || >=10.1.0-M1, <10.1.53 || >=11.0.0-M1, <11.0.20`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 6.1 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Open redirect
- [Apache Tomcat: CLIENT_CERT authentication does not fail as expected](https://agentprime.io/advisories/GHSA-95jq-rwvf-vjx4.md)
  `GHSA-95jq-rwvf-vjx4`, `BIT-tomcat-2026-29145`, `CVE-2026-29145` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=9.0.83, <9.0.116 || >=10.1.0-M7, <10.1.53 || >=11.0.0-M1, <11.0.20`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: Authentication bypass
- [Apache Tomcat has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-8mc5-53m5-3qj2.md)
  `GHSA-8mc5-53m5-3qj2`, `BIT-tomcat-2026-32990`, `CVE-2026-32990` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.113, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.15, <11.0.20`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-20
- [Apache Tomcat: Configured cipher preference order not preserved](https://agentprime.io/advisories/GHSA-69cc-cv78-qc8g.md)
  `GHSA-69cc-cv78-qc8g`, `BIT-tomcat-2026-29129`, `CVE-2026-29129` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=9.0.114, <9.0.116 || >=10.1.51, <10.1.53 || >=11.0.16, <11.0.20`, fixed in `9.0.116`, `10.1.53`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache Tomcat has an HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-563x-q5rq-57qp.md)
  `GHSA-563x-q5rq-57qp`, `BIT-tomcat-2026-24880`, `CVE-2026-24880` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=7.0.0, <9.0.116 || >=10.1.0-M1, <10.1.52 || >=11.0.0-M1, <11.0.20`, fixed in `9.0.116`, `10.1.52`, `11.0.20` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: HTTP request smuggling
- [Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound](https://agentprime.io/advisories/GHSA-xvqc-pp94-fmpx.md)
  `GHSA-xvqc-pp94-fmpx`, `BIT-activemq-2026-40046`, `CVE-2026-40046` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `>=6.0.0, <6.2.4`, fixed in `6.2.4` · CVSS 5.4 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: Memory corruption
- [Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings](https://agentprime.io/advisories/GHSA-gcvm-c75m-h4p4.md)
  `GHSA-gcvm-c75m-h4p4`, `CVE-2026-34020` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=3.1.3, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-598
- [Apache OpenMeetings Uses Hard-coded Cryptographic Key](https://agentprime.io/advisories/GHSA-wqxq-w68r-wg85.md)
  `GHSA-wqxq-w68r-wg85`, `CVE-2026-33266` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=6.1.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Hard-coded credentials
- [Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability](https://agentprime.io/advisories/GHSA-78cg-fc6c-w44w.md)
  `GHSA-78cg-fc6c-w44w`, `CVE-2026-33005` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=3.10, <9.0.0`, fixed in `9.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-274
- [Apache DolphinScheduler vulnerable to sensitive information disclosure](https://agentprime.io/advisories/GHSA-3cjc-vhfm-ffp2.md)
  `GHSA-3cjc-vhfm-ffp2`, `CVE-2025-62188` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `>=3.1.0, <3.2.0`, fixed in `3.2.0` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: Information disclosure
- [quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class](https://agentprime.io/advisories/GHSA-jx2w-vp7f-456q.md)
  `GHSA-jx2w-vp7f-456q`, `CVE-2026-40180` · Maven `io.quarkiverse.openapi.generator:quarkus-openapi-generator`: affected `<2.16.0`, fixed in `2.16.0` · CVSS 7.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Path traversal
- [Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables](https://agentprime.io/advisories/GHSA-gc59-r5jq-98qw.md)
  `GHSA-gc59-r5jq-98qw` · Maven `org.eclipse.jetty.ee10:jetty-ee10`: affected `>=12.1.0, <12.1.7 || >=12.0.0, <12.0.33 || >=11.0.0, <11.0.28 || >=10.0.0, <10.0.28 || >=9.4.0, <9.4.60`, fixed in `12.1.7`, `12.0.33`, `11.0.28`, `10.0.28`, `9.4.60` · CVSS 7.4 High · Withdrawn · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-226
- [XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API](https://agentprime.io/advisories/GHSA-h259-74h5-4rh9.md)
  `GHSA-h259-74h5-4rh9`, `CVE-2026-33229` · Maven `org.xwiki.platform:xwiki-platform-legacy-oldcore` and 1 more: affected `>=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1`, fixed in `17.4.8`, `17.10.1` · CVSS 8.6 High · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Emissary has a Path Traversal via Blacklist Bypass in Configuration API](https://agentprime.io/advisories/GHSA-hxf2-gm22-7vcm.md)
  `GHSA-hxf2-gm22-7vcm`, `CVE-2026-35583` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Path traversal
- [Emissary has a Command Injection via PLACE_NAME Configuration in Executrix](https://agentprime.io/advisories/GHSA-6c37-7w4p-jg9v.md)
  `GHSA-6c37-7w4p-jg9v`, `CVE-2026-35581` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 7.2 High · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [Emissary has GitHub Actions Shell Injection via Workflow Inputs](https://agentprime.io/advisories/GHSA-3g6g-gq4r-xjm9.md)
  `GHSA-3g6g-gq4r-xjm9`, `CVE-2026-35580` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Command injection
- [PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection](https://agentprime.io/advisories/GHSA-wpwf-v25w-54g3.md)
  `GHSA-wpwf-v25w-54g3`, `CVE-2026-5739` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, Code injection
- [PowerJob vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-4fp2-3xgg-jg4w.md)
  `GHSA-4fp2-3xgg-jg4w`, `CVE-2026-5736` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, SQL injection
- [Emissary has Stored XSS via Navigation Template Link Injection](https://agentprime.io/advisories/GHSA-cpm7-cfpx-3hvp.md)
  `GHSA-cpm7-cfpx-3hvp`, `CVE-2026-35571` · Maven `gov.nsa.emissary:emissary`: affected `<8.39.0`, fixed in `8.39.0` · CVSS 4.8 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Java-SDK has a DNS Rebinding Vulnerability](https://agentprime.io/advisories/GHSA-8jxr-pr72-r468.md)
  `GHSA-8jxr-pr72-r468`, `CVE-2026-35568` · Maven `io.modelcontextprotocol.sdk:mcp-core`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 7.6 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-346
- [Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator](https://agentprime.io/advisories/GHSA-qxpc-96fq-wwmg.md)
  `GHSA-qxpc-96fq-wwmg`, `CVE-2026-27314` · Maven `org.apache.cassandra:cassandra-all`: affected `>=5.0-alpha1, <5.0.7`, fixed in `5.0.7` · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Privilege escalation
- [Apache Cassandra has an authenticated DoS over CQL](https://agentprime.io/advisories/GHSA-qffm-gf3j-6mvg.md)
  `GHSA-qffm-gf3j-6mvg`, `CVE-2026-32588` · Maven `org.apache.cassandra:cassandra-all`: affected `>=4.0, <4.0.20 || >=4.1, <4.1.11 || >=5.0, <5.0.7`, fixed in `4.0.20`, `4.1.11`, `5.0.7` · CVSS 6.5 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Denial of service
- [Apache Cassandra has sensitive Information Leak in cqlsh](https://agentprime.io/advisories/GHSA-fh34-c629-p8xj.md)
  `GHSA-fh34-c629-p8xj`, `BIT-cassandra-2026-27315`, `CVE-2026-27315` · Maven `org.apache.cassandra:cassandra-all`: affected `>=4.0, <4.0.20`, fixed in `4.0.20` · CVSS 5.5 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Information disclosure
- [OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via \`jato.clientSession\` Deserialization in OpenAM](https://agentprime.io/advisories/GHSA-2cqq-rpvq-g5qj.md)
  `GHSA-2cqq-rpvq-g5qj`, `CVE-2026-33439` · Maven `org.openidentityplatform.openam:openam`: affected `<16.0.6`, fixed in `16.0.6` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Insecure deserialization
- [Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition](https://agentprime.io/advisories/GHSA-5qcv-4rpc-jp93.md)
  `GHSA-5qcv-4rpc-jp93`, `CVE-2026-35554` · Maven `org.apache.kafka:kafka-clients`: affected `>=2.8.0, <3.9.2 || >=4.0.0, <4.0.2 || >=4.1.0, <4.1.2`, fixed in `3.9.2`, `4.0.2`, `4.1.2` · CVSS 8.7 High · Not analysed yet · Published 7 Apr 2026 · Tags: Race condition, Memory corruption
- [Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans](https://agentprime.io/advisories/GHSA-rxpj-7qvf-xv32.md)
  `GHSA-rxpj-7qvf-xv32`, `BIT-activemq-2026-34197`, `CVE-2026-34197` · Maven `org.apache.activemq:activemq-all` and 1 more: affected `<5.19.5 || >=6.0.0, <6.2.3`, fixed in `5.19.5`, `6.2.3` · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Code injection, CWE-20
- [Apache ActiveMQ: Improper validation and restriction of a classpath path name](https://agentprime.io/advisories/GHSA-h2h4-5m64-m273.md)
  `GHSA-h2h4-5m64-m273`, `BIT-activemq-2026-33227`, `CVE-2026-33227` · Maven `org.apache.activemq:activemq-all` and 3 more: affected `<5.19.3 || >=6.0.0, <6.2.2`, fixed in `5.19.3`, `6.2.2` · CVSS 4.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Path traversal
- [Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim](https://agentprime.io/advisories/GHSA-5v8v-xvjv-57x7.md)
  `GHSA-5v8v-xvjv-57x7`, `CVE-2026-37977` · Maven `org.keycloak:keycloak-services`: affected `<26.4.13 || >=26.5.0, <26.6.3`, fixed in `26.4.13`, `26.6.3` · CVSS 3.7 Low · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-346
- [Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers](https://agentprime.io/advisories/GHSA-2m67-wjpj-xhg9.md)
  `GHSA-2m67-wjpj-xhg9` · Maven `tools.jackson.core:jackson-core`: affected `>=3.0.0, <3.1.1`, fixed in `3.1.1` · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: Denial of service
- [Keycloak: Replay of action tokens via improper handling of single-use entries](https://agentprime.io/advisories/GHSA-rx66-hj7g-28h7.md)
  `GHSA-rx66-hj7g-28h7`, `BIT-keycloak-2026-4325`, `CVE-2026-4325` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-653
- [Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw](https://agentprime.io/advisories/GHSA-hj93-h7pg-fh6v.md)
  `GHSA-hj93-h7pg-fh6v`, `BIT-keycloak-2026-4282`, `CVE-2026-4282` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 7.4 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-653
- [Keycloak: Application-Level DoS via Scope Processing](https://agentprime.io/advisories/GHSA-h4wv-g838-66g3.md)
  `GHSA-h4wv-g838-66g3`, `BIT-keycloak-2026-4634`, `CVE-2026-4634` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-1050
- [Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants](https://agentprime.io/advisories/GHSA-f2hx-5fx3-hmcv.md)
  `GHSA-f2hx-5fx3-hmcv`, `BIT-keycloak-2026-4636`, `CVE-2026-4636` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 8.1 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-551
- [Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint](https://agentprime.io/advisories/GHSA-cjm2-j6cm-6p6m.md)
  `GHSA-cjm2-j6cm-6p6m`, `BIT-keycloak-2026-3872`, `CVE-2026-3872` · Maven `org.keycloak:keycloak-services`: affected `<26.5.7`, fixed in `26.5.7` · CVSS 7.3 High · Not analysed yet · Published 2 Apr 2026 · Tags: Open redirect
- [MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: \*)](https://agentprime.io/advisories/GHSA-hv2w-8mjj-jw22.md)
  `GHSA-hv2w-8mjj-jw22`, `CVE-2026-34237` · Maven `io.modelcontextprotocol.sdk:mcp-core`: affected `>=1.0.0, <1.0.1 || >=1.1.0, <1.1.1 || <0.18.3`, fixed in `1.0.1`, `1.1.1`, `0.18.3` · CVSS 6.1 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-942
- [FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft](https://agentprime.io/advisories/GHSA-vr79-8m62-wh98.md)
  `GHSA-vr79-8m62-wh98`, `CVE-2026-34361` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.validation`: affected `<6.9.4`, fixed in `6.9.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2026 · Tags: Hard-coded credentials, Information disclosure
- [FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing](https://agentprime.io/advisories/GHSA-3ww8-jw56-9f5h.md)
  `GHSA-3ww8-jw56-9f5h`, `CVE-2026-34360` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.core`: affected `<6.9.4`, fixed in `6.9.4` · CVSS 5.8 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect](https://agentprime.io/advisories/GHSA-fgv2-4q4g-wc35.md)
  `GHSA-fgv2-4q4g-wc35`, `CVE-2026-34359` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.core` and 1 more: affected `<6.9.4`, fixed in `6.9.4` · CVSS 7.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-346
- [Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON](https://agentprime.io/advisories/GHSA-x27p-5f68-m644.md)
  `GHSA-x27p-5f68-m644`, `CVE-2026-34214` · Maven `io.trino:trino-iceberg`: affected `>=439, <480`, fixed in `480` · CVSS 7.7 High · Not analysed yet · Published 29 Mar 2026 · Tags: Information disclosure, CWE-212
- [AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities](https://agentprime.io/advisories/GHSA-443w-3rq3-5m5h.md)
  `GHSA-443w-3rq3-5m5h` · Maven `software.amazon.awssdk:cloudfront`: affected `>=2.18.33, <2.41.30`, fixed in `2.41.30` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-116
- [Undertow is Vulnerable to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-vqqj-9cmv-hx43.md)
  `GHSA-vqqj-9cmv-hx43`, `CVE-2026-28369` · Maven `io.undertow:undertow-core`: affected `<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final`, fixed in `2.2.40.Final`, `2.3.25.Final` · CVSS 8.7 High · Not analysed yet · Published 27 Mar 2026 · Tags: HTTP request smuggling
- [Undertow is Vulnerable to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-8v4x-mgvp-p658.md)
  `GHSA-8v4x-mgvp-p658`, `CVE-2026-28368` · Maven `io.undertow:undertow-core`: affected `<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final`, fixed in `2.2.40.Final`, `2.3.25.Final` · CVSS 8.7 High · Not analysed yet · Published 27 Mar 2026 · Tags: HTTP request smuggling
- [Undertow is Vulnerable to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-3gv6-g396-9v4r.md)
  `GHSA-3gv6-g396-9v4r`, `CVE-2026-28367` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Final, <2.3.25.Final || <2.2.40.Final`, fixed in `2.3.25.Final`, `2.2.40.Final` · CVSS 8.7 High · Not analysed yet · Published 27 Mar 2026 · Tags: HTTP request smuggling
- [Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs](https://agentprime.io/advisories/GHSA-mhrg-94vw-45c5.md)
  `GHSA-mhrg-94vw-45c5`, `CVE-2026-22742` · Maven `org.springframework.ai:spring-ai-bedrock-converse`: affected `>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 8.6 High · Not analysed yet · Published 27 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter](https://agentprime.io/advisories/GHSA-7cj7-rcw6-p68v.md)
  `GHSA-7cj7-rcw6-p68v`, `CVE-2026-22743` · Maven `org.springframework.ai:spring-ai-neo4j-store`: affected `>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: SQL injection, Other injection
- [Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters](https://agentprime.io/advisories/GHSA-44f4-gvwj-6qg3.md)
  `GHSA-44f4-gvwj-6qg3`, `CVE-2026-22744` · Maven `org.springframework.ai:spring-ai-redis-store`: affected `>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTAzLTI3VDA2OjMxOjQzLjAwMDAwMFoiLCJHSFNBLTQ0ZjQtZ3Z3ai02cWczIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA0LTEzVDEyOjMxOjE1LjAwMDAwMFoiLCJHSFNBLWpmODktM3E2cS12Y2dyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA0LTEzVDEyOjMxOjE1LjAwMDAwMFoiLCJHSFNBLWpmODktM3E2cS12Y2dyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.