# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS](https://agentprime.io/advisories/GHSA-98qh-xjc8-98pq.md) `GHSA-98qh-xjc8-98pq`, `BIT-postgresql-jdbc-driver-2026-42198`, `CVE-2026-42198` · Maven `org.postgresql:postgresql`: affected `>=42.2.0, <42.7.11`, fixed in `42.7.11` · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: Denial of service - [Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser](https://agentprime.io/advisories/GHSA-xcfg-fcr5-gw9r.md) `GHSA-xcfg-fcr5-gw9r`, `CVE-2026-42188` · Maven `org.geysermc.geyser:core`: affected `<2.9.3`, fixed in `2.9.3` · CVSS 2.4 Low · Not analysed yet · Published 5 May 2026 · Tags: Server-side request forgery (SSRF) - [XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter](https://agentprime.io/advisories/GHSA-42fc-7w97-8vrc.md) `GHSA-42fc-7w97-8vrc`, `CVE-2026-42140` · Maven `org.xwiki.contrib.plantuml:macro-plantuml-macro`: affected `<2.4.1`, fixed in `2.4.1` · CVSS 4.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: Server-side request forgery (SSRF) - [Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-gx3v-wxfj-8h24.md) `GHSA-gx3v-wxfj-8h24`, `CVE-2026-7412` · Maven `org.eclipse.basyx:basyx.sdk`: affected `<2.0.0-milestone-10`, fixed in `2.0.0-milestone-10` · CVSS 8.6 High · Not analysed yet · Published 5 May 2026 · Tags: Server-side request forgery (SSRF) - [Eclipse BaSyx Java Server SDK vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-8gpm-h2mh-36qc.md) `GHSA-8gpm-h2mh-36qc`, `CVE-2026-7411` · Maven `org.eclipse.basyx:basyx.sdk`: affected `<2.0.0-milestone-10`, fixed in `2.0.0-milestone-10` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Path traversal - [Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection](https://agentprime.io/advisories/GHSA-v8h7-rr48-vmmv.md) `GHSA-v8h7-rr48-vmmv`, `CVE-2026-41417` · Maven `io.netty:netty-codec-http`: affected `<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final`, fixed in `4.1.133.Final`, `4.2.13.Final` · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: Other injection, HTTP request smuggling - [Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability](https://agentprime.io/advisories/GHSA-7pwc-h2j2-rjgj.md) `GHSA-7pwc-h2j2-rjgj`, `BIT-thrift-2026-43869`, `CVE-2026-43869` · Maven `org.apache.thrift:libthrift`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Weak cryptography or TLS - [quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations](https://agentprime.io/advisories/GHSA-fr8f-rwjx-f32v.md) `GHSA-fr8f-rwjx-f32v`, `CVE-2026-42333` · Maven `io.quarkiverse.openapi.generator:quarkus-openapi-generator`: affected `<2.16.0-lts || >=2.16.0, <2.17.0`, fixed in `2.16.0-lts`, `2.17.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: Information disclosure - [Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns](https://agentprime.io/advisories/GHSA-c9ph-gxww-7744.md) `GHSA-c9ph-gxww-7744`, `CVE-2026-41901` · Maven `org.thymeleaf:thymeleaf` and 2 more: affected `<3.1.5.RELEASE`, fixed in `3.1.5.RELEASE` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection - [OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange](https://agentprime.io/advisories/GHSA-xj4f-8jjg-vx4q.md) `GHSA-xj4f-8jjg-vx4q`, `CVE-2026-41258` · Maven `org.openmrs.api:openmrs-api`: affected `>=2.7.0, <2.7.9 || >=2.8.0, <2.8.6`, fixed in `2.7.9`, `2.8.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection - [Apache Polaris has an Improper Input Validation issue](https://agentprime.io/advisories/GHSA-w76p-3cgp-qfcm.md) `GHSA-w76p-3cgp-qfcm`, `CVE-2026-42812` · Maven `org.apache.polaris:polaris-runtime-service`: affected `>=0.9.0, <1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Broken access control, CWE-20 - [Apache Polaris has an Improper Input Validation Issue](https://agentprime.io/advisories/GHSA-vxgg-mqx2-3w59.md) `GHSA-vxgg-mqx2-3w59`, `CVE-2026-42810` · Maven `org.apache.polaris:polaris-core`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: CWE-20, CWE-116 - [Apache Polaris has an Improper Input Validation issue](https://agentprime.io/advisories/GHSA-fc3h-c6h7-r83j.md) `GHSA-fc3h-c6h7-r83j`, `CVE-2026-42811` · Maven `org.apache.polaris:polaris-core`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection, CWE-20 - [Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest](https://agentprime.io/advisories/GHSA-cx4m-2p55-rw7j.md) `GHSA-cx4m-2p55-rw7j`, `CVE-2026-42027` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5`, fixed in `2.5.9`, `3.0.0-M3`, `1.9.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Code injection, Insecure deserialization - [Apache Polaris has an Improper Input Validation Issue](https://agentprime.io/advisories/GHSA-8ggj-j522-h5qf.md) `GHSA-8ggj-j522-h5qf`, `CVE-2026-42809` · Maven `org.apache.polaris:polaris-runtime-service`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Broken access control, CWE-20 - [Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation](https://agentprime.io/advisories/GHSA-659w-93r5-9j6m.md) `GHSA-659w-93r5-9j6m`, `CVE-2026-42440` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5`, fixed in `2.5.9`, `3.0.0-M3`, `1.9.5` · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: Denial of service - [Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing](https://agentprime.io/advisories/GHSA-4v8g-86x5-3vrc.md) `GHSA-4v8g-86x5-3vrc`, `CVE-2026-40682` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5`, fixed in `2.5.9`, `3.0.0-M3`, `1.9.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: XML external entities (XXE) - [Apache Atlas has a Code Injection Vulnerability](https://agentprime.io/advisories/GHSA-35xx-9xrg-gwhf.md) `GHSA-35xx-9xrg-gwhf`, `CVE-2026-40563` · Maven `org.apache.atlas:apache-atlas`: affected `>=0.8, <2.5.0`, fixed in `2.5.0` · CVSS 7.1 High · Not analysed yet · Published 4 May 2026 · Tags: Code injection - [OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)](https://agentprime.io/advisories/GHSA-78fc-9688-w8xw.md) `GHSA-78fc-9688-w8xw`, `CVE-2026-40076` · Maven `org.openmrs.web:openmrs-web`: affected `<=2.7.8 || >=2.8.0, <=2.8.5`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2026 · Tags: Path traversal - [Quarkus has Authentication/Authorization bypasses](https://agentprime.io/advisories/GHSA-rc95-pcm8-65v9.md) `GHSA-rc95-pcm8-65v9`, `CVE-2026-39852` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.1 || >=3.21.0, <3.27.3.1 || >=3.30.0, <3.33.1.1 || >=3.34.0, <3.35.1.1`, fixed in `3.20.6.1`, `3.27.3.1`, `3.33.1.1`, `3.35.1.1` · CVSS 8.8 High · Not analysed yet · Published 4 May 2026 · Tags: Authentication bypass, Broken access control, CWE-551 - [OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read](https://agentprime.io/advisories/GHSA-jjgj-cx3q-pw4w.md) `GHSA-jjgj-cx3q-pw4w`, `CVE-2026-40075` · Maven `org.openmrs.web:openmrs-web`: affected `<=2.7.8 || >=2.8.0, <2.8.6`, fixed in `2.8.6` · CVSS 8.2 High · Not analysed yet · Published 4 May 2026 · Tags: Path traversal - [jOpenDocument has an improper restriction of XML external entity reference vulnerability](https://agentprime.io/advisories/GHSA-j9rh-p96m-mhhp.md) `GHSA-j9rh-p96m-mhhp`, `CVE-2026-6501` · Maven `org.jopendocument:jOpenDocument`: affected `<=1.3`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 4 May 2026 · Tags: XML external entities (XXE) - [Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)](https://agentprime.io/advisories/GHSA-vf5j-865m-mq7c.md) `GHSA-vf5j-865m-mq7c`, `CVE-2026-42779` · Maven `org.apache.mina:mina-core`: affected `>=2.1.0, <2.1.12 || >=2.2.0, <2.2.7`, fixed in `2.1.12`, `2.2.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2026 · Tags: Insecure deserialization - [Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)](https://agentprime.io/advisories/GHSA-995c-6rp3-4m4x.md) `GHSA-995c-6rp3-4m4x`, `CVE-2026-42778` · Maven `org.apache.mina:mina-core`: affected `>=2.1.0, <2.1.12 || >=2.2.0, <2.2.7`, fixed in `2.1.12`, `2.2.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2026 · Tags: Insecure deserialization - [Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API](https://agentprime.io/advisories/GHSA-287c-fxr7-3w6c.md) `GHSA-287c-fxr7-3w6c`, `CVE-2026-42404` · Maven `org.apache.neethi:neethi`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 6.5 Medium · Not analysed yet · Published 1 May 2026 · Tags: Server-side request forgery (SSRF) - [Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization](https://agentprime.io/advisories/GHSA-g36m-9g3m-2vmp.md) `GHSA-g36m-9g3m-2vmp`, `CVE-2026-42402` · Maven `org.apache.neethi:neethi`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 7.5 High · Not analysed yet · Published 1 May 2026 · Tags: Denial of service - [Apache Neethi does not properly detect circular references in policy definitions.](https://agentprime.io/advisories/GHSA-2hfh-9h53-qc24.md) `GHSA-2hfh-9h53-qc24`, `CVE-2026-42403` · Maven `org.apache.neethi:neethi`: affected `<3.2.2`, fixed in `3.2.2` · CVSS 7.5 High · Not analysed yet · Published 1 May 2026 · Tags: Denial of service - [Shopizer is vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-fqcw-2xhj-p63g.md) `GHSA-fqcw-2xhj-p63g`, `CVE-2026-36766` · Maven `com.shopizer:shopizer`: affected `<=2.16.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Cross-site scripting (XSS) - [Shopizer has a path traversal issue](https://agentprime.io/advisories/GHSA-f5w4-7ccj-5m75.md) `GHSA-f5w4-7ccj-5m75`, `CVE-2026-36767` · Maven `com.shopizer:shopizer`: affected `<=2.16.0`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Apr 2026 · Tags: Path traversal - [Keycloak has a Forced Browsing issue](https://agentprime.io/advisories/GHSA-hm32-hfmw-rhvg.md) `GHSA-hm32-hfmw-rhvg`, `CVE-2026-7500` · Maven `org.keycloak:keycloak-services`: affected `<=26.6.1`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: Broken access control - [appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution](https://agentprime.io/advisories/GHSA-h8cj-hpmg-636v.md) `GHSA-h8cj-hpmg-636v` · Maven `com.appsmith:interfaces`: affected `<1.99`, fixed in `1.99` · CVSS 7.2 High · Not analysed yet · Published 29 Apr 2026 · Tags: SQL injection - [fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE](https://agentprime.io/advisories/GHSA-prf8-cf2x-rhx7.md) `GHSA-prf8-cf2x-rhx7`, `BIT-hyperledger-fabric-orderer-2026-41586`, `BIT-hyperledger-fabric-peer-2026-41586`, `BIT-hyperledger-fabric-tools-2026-41586`, `CVE-2026-41586` · Maven `org.hyperledger.fabric-sdk-java:fabric-sdk-java`: affected `>=1.0.0, <=2.2.26`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Insecure deserialization - [Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability](https://agentprime.io/advisories/GHSA-jp6g-g3v3-6gvf.md) `GHSA-jp6g-g3v3-6gvf`, `CVE-2026-42525` · Maven `org.jenkins-ci.plugins:azure-ad`: affected `<667.v4c5827a`, fixed in `667.v4c5827a` · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Open redirect - [Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file](https://agentprime.io/advisories/GHSA-f8h4-46xv-h7jj.md) `GHSA-f8h4-46xv-h7jj`, `CVE-2026-42524` · Maven `org.jenkins-ci.plugins:htmlpublisher`: affected `<427.1`, fixed in `427.1` · CVSS 8.0 High · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site scripting (XSS) - [Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test](https://agentprime.io/advisories/GHSA-wg26-8wmj-cf9p.md) `GHSA-wg26-8wmj-cf9p`, `CVE-2026-42522` · Maven `org.jenkins-ci.plugins:github-branch-source`: affected `<1967.1969.v205fd594c821`, fixed in `1967.1969.v205fd594c821` · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Broken access control - [Jenkins GitHub Plugin has an XSS vulnerability](https://agentprime.io/advisories/GHSA-w22p-4x9f-486v.md) `GHSA-w22p-4x9f-486v`, `CVE-2026-42523` · Maven `com.coravy.hudson.plugins.github:github`: affected `<1.46.0.1`, fixed in `1.46.0.1` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Cross-site scripting (XSS) - [Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths](https://agentprime.io/advisories/GHSA-p334-gfhq-c7w6.md) `GHSA-p334-gfhq-c7w6`, `CVE-2026-42519` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.v94c9ce464861`, fixed in `1402.v94c9ce464861` · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Broken access control - [Jenkins Credentials Binding Plugin has a path traversal vulnerability](https://agentprime.io/advisories/GHSA-p2rf-wpxj-mx2g.md) `GHSA-p2rf-wpxj-mx2g`, `CVE-2026-42520` · Maven `org.jenkins-ci.plugins:credentials-binding`: affected `<720.v3f6decef43ea`, fixed in `720.v3f6decef43ea` · CVSS 7.5 High · Not analysed yet · Published 29 Apr 2026 · Tags: Path traversal - [Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors](https://agentprime.io/advisories/GHSA-jp9r-mmhw-vff3.md) `GHSA-jp9r-mmhw-vff3`, `CVE-2026-42521` · Maven `org.jenkins-ci.plugins:matrix-auth`: affected `>=2.0-beta-1, <3.2.10`, fixed in `3.2.10` · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Insecure deserialization - [Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.](https://agentprime.io/advisories/GHSA-wg35-8jpf-2xv3.md) `GHSA-wg35-8jpf-2xv3`, `CVE-2026-22741` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47`, fixed in `7.0.7`, `6.2.18` · CVSS 3.1 Low · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-524 - [Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources](https://agentprime.io/advisories/GHSA-6p4f-wcwh-5vvm.md) `GHSA-6p4f-wcwh-5vvm`, `CVE-2026-22745` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47`, fixed in `7.0.7`, `6.2.18` · CVSS 5.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Denial of service - [Spring Framework DoS with Multipart Temp Files in WebFlux](https://agentprime.io/advisories/GHSA-5843-p793-ghmm.md) `GHSA-5843-p793-ghmm`, `CVE-2026-22740` · Maven `org.springframework:spring-webflux`: affected `>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47`, fixed in `7.0.7`, `6.2.18` · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Denial of service - [xxl-job has a Resource Injection issue](https://agentprime.io/advisories/GHSA-gw2x-mfwr-h46p.md) `GHSA-gw2x-mfwr-h46p`, `CVE-2026-7303` · Maven `com.xuxueli:xxl-job-admin`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-99 - [Spring gRPC SecurityContext leaks across requests upon authorization failure](https://agentprime.io/advisories/GHSA-4g9c-3x4p-mfpp.md) `GHSA-4g9c-3x4p-mfpp`, `CVE-2026-40968` · Maven `org.springframework.grpc:spring-grpc`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 4.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-653 - [Spring gRPC AuthenticationException messages are reflected to remote client](https://agentprime.io/advisories/GHSA-37w2-q6vh-45v6.md) `GHSA-37w2-q6vh-45v6`, `CVE-2026-40969` · Maven `org.springframework.grpc:spring-grpc`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 3.7 Low · Not analysed yet · Published 28 Apr 2026 · Tags: Information disclosure - [Apache Thrift has an issue with Java TSSLTransportFactory hostname verification](https://agentprime.io/advisories/GHSA-gf47-qgg5-9g9q.md) `GHSA-gf47-qgg5-9g9q`, `BIT-thrift-2026-41603`, `CVE-2026-41603` · Maven `org.apache.thrift:libthrift`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 7.4 High · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS - [Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration](https://agentprime.io/advisories/GHSA-v6x6-pjxw-3pv2.md) `GHSA-v6x6-pjxw-3pv2`, `CVE-2026-40966` · Maven `org.springframework.ai:spring-ai-advisors-vector-store`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 5.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Broken access control - [Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory](https://agentprime.io/advisories/GHSA-r5hp-3cgj-j6xv.md) `GHSA-r5hp-3cgj-j6xv`, `CVE-2026-40979` · Maven `org.springframework.ai:spring-ai-transformers`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 6.1 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-377 - [Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()](https://agentprime.io/advisories/GHSA-63c8-m9m2-cvr3.md) `GHSA-63c8-m9m2-cvr3`, `CVE-2026-40978` · Maven `org.springframework.ai:spring-ai-azure-cosmos-db-store`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 8.8 High · Not analysed yet · Published 28 Apr 2026 · Tags: SQL injection - [Spring AI Vulnerable to OOM by attacker-controlled PDF](https://agentprime.io/advisories/GHSA-26gg-9gv2-v27j.md) `GHSA-26gg-9gv2-v27j`, `CVE-2026-40980` · Maven `org.springframework.ai:spring-ai-pdf-document-reader`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Denial of service - [Spring AI has a VectorStore FilterExpression Converter injection](https://agentprime.io/advisories/GHSA-qc4j-qjqx-vr58.md) `GHSA-qc4j-qjqx-vr58`, `CVE-2026-40967` · Maven `org.springframework.ai:spring-ai-vector-store`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5`, fixed in `1.0.6`, `1.1.5` · CVSS 8.6 High · Not analysed yet · Published 28 Apr 2026 · Tags: Code injection - [Spring Boot accepts predictable temp directory without ownership verification](https://agentprime.io/advisories/GHSA-wwpq-f5c3-7hvx.md) `GHSA-wwpq-f5c3-7hvx`, `CVE-2026-40973` · Maven `org.springframework.boot:spring-boot`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 7.0 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-377 - [Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification](https://agentprime.io/advisories/GHSA-mqvw-jfmh-93qq.md) `GHSA-mqvw-jfmh-93qq`, `CVE-2026-40974` · Maven `org.springframework.boot:spring-boot-cassandra`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 5.0 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS - [Spring Boot's random value property source uses a weak PRNG unsuitable for secrets](https://agentprime.io/advisories/GHSA-m4x9-hx6x-2c43.md) `GHSA-m4x9-hx6x-2c43`, `CVE-2026-40975` · Maven `org.springframework.boot:spring-boot-cassandra`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS - [Spring Boot's default security filter chain has no authorization rule with Actuator but without Health](https://agentprime.io/advisories/GHSA-8v8j-3hxp-93wr.md) `GHSA-8v8j-3hxp-93wr`, `CVE-2026-40976` · Maven `org.springframework.boot:spring-boot`: affected `>=4.0.0, <4.0.6`, fixed in `4.0.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2026 · Tags: Broken access control, CWE-305 - [Spring Boot's PID file write follows symlinks at predictable default path](https://agentprime.io/advisories/GHSA-5368-6h4h-gr29.md) `GHSA-5368-6h4h-gr29`, `CVE-2026-40977` · Maven `org.springframework.boot:spring-boot-cassandra`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 4.7 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Path traversal - [Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker](https://agentprime.io/advisories/GHSA-9vc8-qppq-wvxc.md) `GHSA-9vc8-qppq-wvxc`, `CVE-2026-40971` · Maven `org.springframework.boot:spring-boot-rabbitmq`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14`, fixed in `4.0.6`, `3.5.14` · CVSS 5.0 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS - [Spring Boot DevTools remote secret comparison is vulnerable to timing attacks](https://agentprime.io/advisories/GHSA-56v8-86gj-66jp.md) `GHSA-56v8-86gj-66jp`, `CVE-2026-40972` · Maven `org.springframework.boot:spring-boot-devtools`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32`, fixed in `4.0.6`, `3.5.14` · CVSS 7.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-208 - [Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.](https://agentprime.io/advisories/GHSA-c96x-rpm4-349p.md) `GHSA-c96x-rpm4-349p`, `CVE-2026-40970` · Maven `org.springframework.boot:spring-boot-elasticsearch`: affected `>=4.0.0, <4.0.6`, fixed in `4.0.6` · CVSS 5.0 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Weak cryptography or TLS - [Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment](https://agentprime.io/advisories/GHSA-j2q8-xx3q-8fqh.md) `GHSA-j2q8-xx3q-8fqh`, `CVE-2026-41081` · Maven `org.apache.storm:storm-client`: affected `<2.8.7`, fixed in `2.8.7` · CVSS 6.5 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Authentication bypass Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .