# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade](https://agentprime.io/advisories/GHSA-82fm-wpc2-5pmp.md)
  `GHSA-82fm-wpc2-5pmp`, `CVE-2026-40557` · Maven `org.apache.storm:storm-metrics-prometheus`: affected `>=2.6.3, <2.8.7`, fixed in `2.8.7` · CVSS 4.8 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Weak cryptography or TLS
- [Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)](https://agentprime.io/advisories/GHSA-f2wh-grmh-r6jm.md)
  `GHSA-f2wh-grmh-r6jm`, `CVE-2026-41409` · Maven `org.apache.mina:mina-core`: affected `>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6`, fixed in `2.0.28`, `2.1.11`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Apache camel-coap allows header injection that can lead to remote code execution](https://agentprime.io/advisories/GHSA-695c-x5gc-94gj.md)
  `GHSA-695c-x5gc-94gj`, `CVE-2026-33453` · Maven `org.apache.camel:camel-coap`: affected `>=4.14.0, <4.14.6 || >=4.18.0, <4.18.1`, fixed in `4.14.6`, `4.18.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Broken access control
- [Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-5rc6-9qfp-8vwg.md)
  `GHSA-5rc6-9qfp-8vwg`, `CVE-2026-27172` · Maven `org.apache.camel:camel-consul`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1`, fixed in `4.14.6`, `4.18.1` · CVSS 6.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-4xwx-hvv7-7prj.md)
  `GHSA-4xwx-hvv7-7prj`, `CVE-2026-40858` · Maven `org.apache.camel:camel-infinispan`: affected `>=4.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.7`, `4.18.2`, `4.20.0` · CVSS 8.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Apache Camel's Camel-Mail component is vulnerable to Camel message header injection](https://agentprime.io/advisories/GHSA-2vqf-x7g4-7c2g.md)
  `GHSA-2vqf-x7g4-7c2g`, `CVE-2026-33454` · Maven `org.apache.camel:camel-mail`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.1`, fixed in `4.14.6`, `4.18.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization, CWE-1173
- [Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel](https://agentprime.io/advisories/GHSA-27vm-5vpj-rp5g.md)
  `GHSA-27vm-5vpj-rp5g`, `CVE-2026-40022` · Maven `org.apache.camel:camel-platform-http-main`: affected `>=4.14.1, <4.14.6 || >=4.18.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 8.2 High · Not analysed yet · Published 27 Apr 2026 · Tags: Authentication bypass, CWE-551
- [Camel-MINA Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-vpr3-2659-rw55.md)
  `GHSA-vpr3-2659-rw55`, `CVE-2026-40473` · Maven `org.apache.camel:camel-mina`: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 8.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage](https://agentprime.io/advisories/GHSA-m5vh-3fw5-5wgh.md)
  `GHSA-m5vh-3fw5-5wgh`, `CVE-2026-40860` · Maven `org.apache.camel:camel-activemq` and 5 more: affected `>=3.0.0, <4.14.7 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.7`, `4.18.2`, `4.20.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Apache Camel has an incomplete fix for CVE-2025-27636](https://agentprime.io/advisories/GHSA-jg2m-9x48-3gvj.md)
  `GHSA-jg2m-9x48-3gvj`, `CVE-2026-40453` · Maven `org.apache.camel:camel-coap` and 3 more: affected `>=3.0.0, <4.14.6 || >=4.15.0, <4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.14.6`, `4.18.2`, `4.20.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: CWE-178
- [Apache MINA vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-8297-v2rf-2p32.md)
  `GHSA-8297-v2rf-2p32`, `CVE-2026-41635` · Maven `org.apache.mina:mina-core`: affected `>=2.0.0, <2.0.28 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.6`, fixed in `2.0.28`, `2.1.11`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Camel-PQC Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-v3vg-332r-mw99.md)
  `GHSA-v3vg-332r-mw99`, `CVE-2026-40048` · Maven `org.apache.camel:camel-pqc`: affected `<4.18.2 || >=4.19.0, <4.20.0`, fixed in `4.18.2`, `4.20.0` · CVSS 7.8 High · Not analysed yet · Published 27 Apr 2026 · Tags: Insecure deserialization
- [Dynamic-Datasource has an Injection vulnerability](https://agentprime.io/advisories/GHSA-6rmm-pg23-5f8q.md)
  `GHSA-6rmm-pg23-5f8q`, `CVE-2026-7045` · Maven `com.baomidou:dynamic-datasource-spring`: affected `<=4.5.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Other injection, CWE-707
- [Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization](https://agentprime.io/advisories/GHSA-cwq5-8pvq-j65j.md)
  `GHSA-cwq5-8pvq-j65j`, `CVE-2026-33524` · Maven `io.github.ndsev:zserio-runtime`: affected `<2.18.1`, fixed in `2.18.1` · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2026 · Tags: Denial of service
- [Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection](https://agentprime.io/advisories/GHSA-w3w2-mpp5-92gm.md)
  `GHSA-w3w2-mpp5-92gm`, `BIT-activemq-2026-40466`, `CVE-2026-40466` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.6 || >=6.0.0, <6.2.5`, fixed in `5.19.6`, `6.2.5` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, CWE-20
- [Apache ActiveMQ Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-mr6m-xj7v-3cv3.md)
  `GHSA-mr6m-xj7v-3cv3`, `BIT-activemq-2026-41044`, `CVE-2026-41044` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.6 || >=6.0.0, <6.2.5`, fixed in `5.19.6`, `6.2.5` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, CWE-20
- [Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-f786-9c63-8xr8.md)
  `GHSA-f786-9c63-8xr8`, `CVE-2025-62233` · Maven `org.apache.dolphinscheduler:dolphinscheduler` and 1 more: affected `>=3.2.0, <3.3.1`, fixed in `3.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Insecure deserialization
- [Apache DolphinScheduler has an Incorrect Authorization Vulnerability](https://agentprime.io/advisories/GHSA-72mv-wwvm-vgp5.md)
  `GHSA-72mv-wwvm-vgp5`, `CVE-2026-23902` · Maven `org.apache.dolphinscheduler:dolphinscheduler`: affected `<3.4.1`, fixed in `3.4.1` · CVSS 8.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: Broken access control
- [Apache ActiveMQ Vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-2jp3-2923-9h52.md)
  `GHSA-2jp3-2923-9h52`, `BIT-activemq-2026-41043`, `CVE-2026-41043` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.6 || >=6.0.0, <6.2.5`, fixed in `5.19.6`, `6.2.5` · CVSS 6.5 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Apktool: Path Traversal to Arbitrary File Write](https://agentprime.io/advisories/GHSA-m8mh-x359-vm8m.md)
  `GHSA-m8mh-x359-vm8m`, `CVE-2026-39973` · Maven `org.apktool:apktool-lib`: affected `>=3.0.0, <3.0.2`, fixed in `3.0.2` · CVSS 7.1 High · Not analysed yet · Published 23 Apr 2026 · Tags: Path traversal
- [H2O-3 is Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-qmcv-hh7c-3m56.md)
  `GHSA-qmcv-hh7c-3m56`, `CVE-2026-3960`, `PYSEC-2026-2180` · Maven `ai.h2o:h2o-core`: affected `<3.46.0.10`, fixed in `3.46.0.10` · CVSS 5.9 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection
- [Silverpeas Core has a reflected cross-site scripting vulnerability](https://agentprime.io/advisories/GHSA-vmj7-7xmm-4349.md)
  `GHSA-vmj7-7xmm-4349`, `CVE-2026-30139` · Maven `org.silverpeas.core:silverpeas-core-war` and 1 more: affected `<=6.4-feature13197`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site scripting (XSS)
- [camel-infinispan Vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-xfxp-ppx7-cqrp.md)
  `GHSA-xfxp-ppx7-cqrp`, `CVE-2026-6857` · Maven `org.apache.camel:camel-infinispan`: affected `<4.20.0`, fixed in `4.20.0` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: Insecure deserialization
- [OpenRemote has Improper Access Control via updateUserRealmRoles function](https://agentprime.io/advisories/GHSA-49vv-25qx-mg44.md)
  `GHSA-49vv-25qx-mg44`, `CVE-2026-41166` · Maven `io.openremote:openremote-manager`: affected `<1.22.1`, fixed in `1.22.1` · CVSS 7.0 High · Not analysed yet · Published 22 Apr 2026 · Tags: Broken access control
- [Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification](https://agentprime.io/advisories/GHSA-v468-qcjx-r72w.md)
  `GHSA-v468-qcjx-r72w`, `CVE-2026-40542` · Maven `org.apache.httpcomponents.client5:httpclient5`: affected `>=5.6-alpha1, <5.6.1`, fixed in `5.6.1` · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: Authentication bypass, CWE-325
- [Spring Security has Potential Security Misconfiguration when Using withIssuerLocation](https://agentprime.io/advisories/GHSA-cvc6-q2cp-2xhw.md)
  `GHSA-cvc6-q2cp-2xhw`, `CVE-2026-22748` · Maven `org.springframework.security:spring-security-oauth2-jose`: affected `>=6.3.0, <=6.3.14 || >=6.4.0, <=6.4.14 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5`, fixed in `6.5.10`, `7.0.5` · CVSS 5.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-20
- [Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers](https://agentprime.io/advisories/GHSA-4wrg-8wpc-h923.md)
  `GHSA-4wrg-8wpc-h923`, `CVE-2026-22753` · Maven `org.springframework.security:spring-security-config`: affected `>=7.0.0, <7.0.5`, fixed in `7.0.5` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-693
- [Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules](https://agentprime.io/advisories/GHSA-4vrc-j85c-598c.md)
  `GHSA-4vrc-j85c-598c`, `CVE-2026-22754` · Maven `org.springframework.security:spring-security-config`: affected `>=7.0.0, <7.0.5`, fixed in `7.0.5` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: Broken access control, CWE-551
- [Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider](https://agentprime.io/advisories/GHSA-vxf7-qj7q-83fh.md)
  `GHSA-vxf7-qj7q-83fh`, `CVE-2026-22746` · Maven `org.springframework.security:spring-security-core`: affected `>=5.7.0, <=5.7.22 || >=5.8.0, <=5.8.24 || >=6.3.0, <=6.3.15 || >=6.4.0, <=6.4.15 || >=6.5.0, <6.5.10 || >=7.0.0, <7.0.5`, fixed in `6.5.10`, `7.0.5` · CVSS 3.7 Low · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-208
- [Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates](https://agentprime.io/advisories/GHSA-2jrg-rf5x-568g.md)
  `GHSA-2jrg-rf5x-568g`, `CVE-2026-22747` · Maven `org.springframework.security:spring-security-web`: affected `>=7.0.0, <7.0.5`, fixed in `7.0.5` · CVSS 6.8 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS
- [Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured](https://agentprime.io/advisories/GHSA-x2wq-9x2f-fhj7.md)
  `GHSA-x2wq-9x2f-fhj7`, `CVE-2026-22751` · Maven `org.springframework.security:spring-security-core`: affected `>=6.5.0, <6.5.10 || >=7.0.3, <7.0.5 || >=6.4.0, <=6.4.13`, fixed in `6.5.10`, `7.0.5` · CVSS 4.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Race condition
- [Spinnaker: RCE via expression parsing due to unrestricted context handling](https://agentprime.io/advisories/GHSA-69rw-45wj-g4v6.md)
  `GHSA-69rw-45wj-g4v6`, `CVE-2026-32613` · Maven `io.spinnaker.echo:echo-pipelinetriggers`: affected `>=2026.0-0, <2026.0.1 || >=2025.4-0, <2025.4.2 || <2025.3.2`, fixed in `2026.0.1`, `2025.4.2`, `2025.3.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Code injection
- [Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths](https://agentprime.io/advisories/GHSA-x3j7-7pgj-h87r.md)
  `GHSA-x3j7-7pgj-h87r`, `CVE-2026-32604` · Maven `io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo`: affected `<2026.0.1`, fixed in `2026.0.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-20
- [Apache Kafka exposes sensitive information in its DEBUG logs](https://agentprime.io/advisories/GHSA-wf66-mphr-4c4r.md)
  `GHSA-wf66-mphr-4c4r`, `BIT-kafka-2026-33558`, `CVE-2026-33558` · Maven `org.apache.kafka:kafka-clients`: affected `>=0.11.0, <3.9.2 || >=4.0.0, <4.0.1`, fixed in `3.9.2`, `4.0.1` · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Information disclosure, CWE-533
- [Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation](https://agentprime.io/advisories/GHSA-28jg-cgg7-j4wc.md)
  `GHSA-28jg-cgg7-j4wc`, `BIT-kafka-2026-33557`, `CVE-2026-33557` · Maven `org.apache.kafka:kafka-clients`: affected `>=4.1.0, <4.1.2`, fixed in `4.1.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Authentication bypass, CWE-1285
- [Bouncy Castle Has Covert Timing Channel Vulnerability](https://agentprime.io/advisories/GHSA-p93r-85wp-75v3.md)
  `GHSA-p93r-85wp-75v3`, `CVE-2026-5598` · Maven `org.bouncycastle:bcprov-jdk14` and 2 more: affected `>=1.71, <1.84`, fixed in `1.84` · CVSS 8.9 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-385
- [Bouncy Castle Uncontrolled Resource Consumption vulnerability](https://agentprime.io/advisories/GHSA-cj8j-37rh-8475.md)
  `GHSA-cj8j-37rh-8475`, `CVE-2026-3505` · Maven `org.bouncycastle:bcpg-jdk12` and 6 more: affected `<=130`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 17 Apr 2026 · Tags: Denial of service
- [Bouncy Castle has an LDAP injection](https://agentprime.io/advisories/GHSA-c3fc-8qff-9hwx.md)
  `GHSA-c3fc-8qff-9hwx`, `CVE-2026-0636` · Maven `org.bouncycastle:bcprov-jdk14` and 2 more: affected `>=1.74, <1.84`, fixed in `1.84` · CVSS 5.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Other injection
- [Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks](https://agentprime.io/advisories/GHSA-574f-3g2m-x479.md)
  `GHSA-574f-3g2m-x479`, `CVE-2025-14813` · Maven `org.bouncycastle:bcprov-debug-jdk14` and 13 more: affected `>=1.59, <=1.80.1 || >=1.82, <1.84`, fixed in `1.84` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Weak cryptography or TLS, CWE-323
- [PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability](https://agentprime.io/advisories/GHSA-xw5c-jc7x-gf75.md)
  `GHSA-xw5c-jc7x-gf75`, `CVE-2026-40458` · Maven `org.pac4j:pac4j-core`: affected `<5.7.10 || >=6.0.0-RC1, <6.4.1`, fixed in `5.7.10`, `6.4.1` · CVSS 7.0 High · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [OmniFaces: EL injection via crafted resource name in wildcard CDN mapping](https://agentprime.io/advisories/GHSA-vp6r-9m58-5xv8.md)
  `GHSA-vp6r-9m58-5xv8`, `CVE-2026-41883` · Maven `org.omnifaces:omnifaces`: affected `<1.14.2 || >=2.0-RC1, <2.7.32 || >=3.0-RC1, <3.14.16 || >=4.0-M1, <4.7.5 || >=5.0-M1, <5.2.3`, fixed in `1.14.2`, `2.7.32`, `3.14.16`, `4.7.5`, `5.2.3` · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection
- [Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix](https://agentprime.io/advisories/GHSA-hf5p-q87m-crj7.md)
  `GHSA-hf5p-q87m-crj7`, `CVE-2026-41245` · Maven `com.github.junrar:junrar`: affected `<7.5.10`, fixed in `7.5.10` · CVSS 5.9 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Path traversal
- [Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService](https://agentprime.io/advisories/GHSA-hfrg-mcvw-8mch.md)
  `GHSA-hfrg-mcvw-8mch`, `CVE-2026-34164` · Maven `com.ritense.valtimo:inbox`: affected `>=13.0.0.RELEASE, <13.22.0.RELEASE`, fixed in `13.22.0.RELEASE` · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Information disclosure
- [SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information](https://agentprime.io/advisories/GHSA-27h3-crw2-q36w.md)
  `GHSA-27h3-crw2-q36w`, `CVE-2026-30778` · Maven `org.apache.skywalking:server-core`: affected `>=9.7.0, <10.4.0`, fixed in `10.4.0` · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-202
- [Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf](https://agentprime.io/advisories/GHSA-xjw8-8c5c-9r79.md)
  `GHSA-xjw8-8c5c-9r79`, `CVE-2026-40478` · Maven `org.thymeleaf:thymeleaf` and 2 more: affected `<3.1.4.RELEASE`, fixed in `3.1.4.RELEASE` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: Code injection
- [Improper restriction of the scope of accessible objects in Thymeleaf expressions](https://agentprime.io/advisories/GHSA-r4v4-5mwr-2fwr.md)
  `GHSA-r4v4-5mwr-2fwr`, `CVE-2026-40477` · Maven `org.thymeleaf:thymeleaf` and 2 more: affected `<3.1.4.RELEASE`, fixed in `3.1.4.RELEASE` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: Code injection
- [OpenRemote has XXE in Velbus Asset Import](https://agentprime.io/advisories/GHSA-g24f-mgc3-jwwc.md)
  `GHSA-g24f-mgc3-jwwc`, `CVE-2026-40882` · Maven `io.openremote:openremote-manager`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 7.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: XML external entities (XXE)
- [Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache](https://agentprime.io/advisories/GHSA-xmj9-7625-f634.md)
  `GHSA-xmj9-7625-f634`, `CVE-2026-40942` · Maven `dev.dsf:dsf-bpe-process-api-v2` and 1 more: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-670
- [Data Sharing Framework is Missing Session Timeout for OIDC Sessions](https://agentprime.io/advisories/GHSA-gj7p-595x-qwf5.md)
  `GHSA-gj7p-595x-qwf5`, `CVE-2026-40939` · Maven `dev.dsf:dsf-bpe-server` and 2 more: affected `*`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Authentication bypass
- [Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules](https://agentprime.io/advisories/GHSA-wg6q-6289-32hp.md)
  `GHSA-wg6q-6289-32hp`, `CVE-2026-5588` · Maven `org.bouncycastle:bcpkix-debug-jdk14` and 6 more: affected `>=1.49, <1.84`, fixed in `1.84` · CVSS 6.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: Weak cryptography or TLS
- [Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing](https://agentprime.io/advisories/GHSA-355h-qmc2-wpwf.md)
  `GHSA-355h-qmc2-wpwf`, `CVE-2026-2332` · Maven `org.eclipse.jetty:jetty-http`: affected `>=12.1.0, <12.1.7 || >=12.0.0, <12.0.33 || >=11.0.0, <11.0.29 || >=10.0.0, <10.0.28 || >=9.4.0, <9.4.60`, fixed in `12.1.7`, `12.0.33`, `11.0.29`, `10.0.28`, `9.4.60` · CVSS 7.4 High · Not analysed yet · Published 14 Apr 2026 · Tags: HTTP request smuggling
- [XWiki's REST APIs can list all pages/spaces, leading to unavailability](https://agentprime.io/advisories/GHSA-mrqg-xmgm-rc5g.md)
  `GHSA-mrqg-xmgm-rc5g`, `CVE-2026-40104` · Maven `org.xwiki.platform:xwiki-platform-legacy-oldcore` and 1 more: affected `>=1.8-rc-1, <16.10.16 || >=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1`, fixed in `16.10.16`, `17.4.8`, `17.10.1` · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Denial of service
- [XWiki has Reflected Cross-Site Scripting (XSS) in page history compare](https://agentprime.io/advisories/GHSA-w4fj-87j5-f25c.md)
  `GHSA-w4fj-87j5-f25c`, `CVE-2026-40105` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `>=10.4-rc-1, <16.10.16 || >=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1`, fixed in `16.10.16`, `17.4.8`, `17.10.1` · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Expression Injection in OpenRemote](https://agentprime.io/advisories/GHSA-7mqr-33rv-p3mp.md)
  `GHSA-7mqr-33rv-p3mp`, `CVE-2026-39842` · Maven `io.openremote:openremote-manager`: affected `<1.22.0`, fixed in `1.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Code injection
- [Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page](https://agentprime.io/advisories/GHSA-m32f-8vh9-2hh3.md)
  `GHSA-m32f-8vh9-2hh3`, `CVE-2026-37980` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code](https://agentprime.io/advisories/GHSA-gcj8-76p4-g2fq.md)
  `GHSA-gcj8-76p4-g2fq`, `CVE-2026-33929` · Maven `org.apache.pdfbox:pdfbox-examples`: affected `>=2.0.24, <2.0.37 || >=3.0.0, <3.0.8`, fixed in `2.0.37`, `3.0.8` · CVSS 4.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Path traversal
- [AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects](https://agentprime.io/advisories/GHSA-cmxv-58fp-fm3g.md)
  `GHSA-cmxv-58fp-fm3g`, `CVE-2026-40490` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0.Beta1, <3.0.9 || >=2.0.0, <2.14.5`, fixed in `3.0.9`, `2.14.5` · CVSS 6.8 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: Information disclosure
- [Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables](https://agentprime.io/advisories/GHSA-r7p8-xq5m-436c.md)
  `GHSA-r7p8-xq5m-436c`, `CVE-2026-5795` · Maven `org.eclipse.jetty.ee10:jetty-ee10-jaspi` and 4 more: affected `>=12.1.0, <12.1.8 || >=12.0.0, <12.0.34`, fixed in `12.1.8`, `12.0.34` · CVSS 7.4 High · Not analysed yet · Published 14 Apr 2026 · Tags: Authentication bypass, CWE-226
- [Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix](https://agentprime.io/advisories/GHSA-3p24-9x7v-7789.md)
  `GHSA-3p24-9x7v-7789`, `CVE-2026-35582` · Maven `gov.nsa.emissary:emissary`: affected `<8.43.0`, fixed in `8.43.0` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Command injection, CWE-116
- [Apache Storm: Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-jf89-3q6q-vcgr.md)
  `GHSA-jf89-3q6q-vcgr`, `CVE-2026-35337` · Maven `org.apache.storm:storm-client`: affected `<2.8.6`, fixed in `2.8.6` · CVSS 8.8 High · Not analysed yet · Published 13 Apr 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA0LTEzVDEyOjMxOjE1LjAwMDAwMFoiLCJHSFNBLWpmODktM3E2cS12Y2dyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA0LTI3VDE1OjMwOjUyLjAwMDAwMFoiLCJHSFNBLWoycTgteHgzcS04ZnFoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA0LTI3VDE1OjMwOjUyLjAwMDAwMFoiLCJHSFNBLWoycTgteHgzcS04ZnFoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.