# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation](https://agentprime.io/advisories/GHSA-rcgg-9c38-7xpx.md) `GHSA-rcgg-9c38-7xpx`, `CVE-2026-45292` · Maven `io.opentelemetry:opentelemetry-api` and 1 more: affected `<1.62.0`, fixed in `1.62.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Denial of service - [Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading](https://agentprime.io/advisories/GHSA-wmmv-vvg5-993q.md) `GHSA-wmmv-vvg5-993q`, `CVE-2026-8178` · Maven `com.amazon.redshift:redshift-jdbc42`: affected `<2.2.2`, fixed in `2.2.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Apache Commons Configuration: StackOverflowError for YAML input with cycles](https://agentprime.io/advisories/GHSA-337m-mw94-2v6g.md) `GHSA-337m-mw94-2v6g`, `CVE-2026-45205` · Maven `org.apache.commons:commons-configuration2`: affected `>=2.2, <2.15.0`, fixed in `2.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Denial of service - [Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy](https://agentprime.io/advisories/GHSA-2rgp-f66f-4499.md) `GHSA-2rgp-f66f-4499`, `CVE-2026-45083` · Maven `io.goobi.viewer:viewer-core`: affected `>=4.8.0, <=26.04`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Authentication bypass - [Mapfish Print: Remote Code Injection (RCE) in Dynamic table](https://agentprime.io/advisories/GHSA-q7m6-wpvf-mvwx.md) `GHSA-q7m6-wpvf-mvwx`, `CVE-2026-44672` · Maven `org.mapfish.print:print-lib` and 1 more: affected `>=3.23.0, <3.28.28 || >=3.29.0, <3.30.30 || >=3.31.0, <3.31.21 || >=3.32.0, <3.33.14 || >=3.34.0, <4.0.3`, fixed in `3.28.28`, `3.30.30`, `3.31.21`, `3.33.14`, `4.0.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [Security feature bypass vulnerability in Azure Key Vault Keys library for Java](https://agentprime.io/advisories/GHSA-97jf-46m3-8953.md) `GHSA-97jf-46m3-8953`, `CVE-2026-33117` · Maven `com.azure:azure-security-keyvault-keys`: affected `<4.10.6`, fixed in `4.10.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, Weak cryptography or TLS - [Apache Tomcat - HTTP/2 request headers not validated](https://agentprime.io/advisories/GHSA-r29c-68gh-xp6x.md) `GHSA-r29c-68gh-xp6x`, `BIT-tomcat-2026-41293`, `CVE-2026-41293` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=8.5.0, <9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-20 - [Apache Tomcat - Digest authenticator will authenticate any unknown user](https://agentprime.io/advisories/GHSA-h6fc-48rj-7qqh.md) `GHSA-h6fc-48rj-7qqh`, `BIT-tomcat-2026-43512`, `CVE-2026-43512` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-592 - [Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling](https://agentprime.io/advisories/GHSA-gx5v-xp9w-j4cg.md) `GHSA-gx5v-xp9w-j4cg`, `BIT-tomcat-2026-41284`, `CVE-2026-41284` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: Denial of service - [Apache Tomcat - WebSocket authentication header exposure](https://agentprime.io/advisories/GHSA-fv25-8xcx-gqjc.md) `GHSA-fv25-8xcx-gqjc`, `BIT-tomcat-2026-42498`, `CVE-2026-42498` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 7.3 High · Not analysed yet · Published 12 May 2026 · Tags: Information disclosure - [Apache Tomcat - AJP secret compared in non-constant time](https://agentprime.io/advisories/GHSA-9m89-8frq-c98c.md) `GHSA-9m89-8frq-c98c`, `BIT-tomcat-2026-43514`, `CVE-2026-43514` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 3.7 Low · Not analysed yet · Published 12 May 2026 · Tags: CWE-208 - [Apache Tomcat: LockOutRealm treats user names as case-sensitive](https://agentprime.io/advisories/GHSA-5mp6-jrq3-r938.md) `GHSA-5mp6-jrq3-r938`, `BIT-tomcat-2026-43513`, `CVE-2026-43513` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-178 - [Apache Tomcat - Security constraints not correctly applied](https://agentprime.io/advisories/GHSA-5m62-pw8w-7w9f.md) `GHSA-5m62-pw8w-7w9f`, `BIT-tomcat-2026-43515`, `CVE-2026-43515` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Broken access control - [sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)](https://agentprime.io/advisories/GHSA-x3r2-fj3r-g5mv.md) `GHSA-x3r2-fj3r-g5mv`, `CVE-2026-45091` · Maven `io.github.davidalmeidac:sealed-env-core` and 1 more: affected `<0.1.0-alpha.4`, fixed in `0.1.0-alpha.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Information disclosure, Hard-coded credentials - [Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage](https://agentprime.io/advisories/GHSA-q62f-h9x2-gcqc.md) `GHSA-q62f-h9x2-gcqc`, `CVE-2026-41712` · Maven `org.springframework.ai:spring-ai-advisors-vector-store` and 2 more: affected `<1.0.7 || >=1.1.0-M1, <1.1.6 || >=2.0.0-M1, <2.0.0-M6`, fixed in `1.0.7`, `1.1.6`, `2.0.0-M6` · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: Broken access control - [Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor](https://agentprime.io/advisories/GHSA-5852-phmh-8fhr.md) `GHSA-5852-phmh-8fhr`, `CVE-2026-41713` · Maven `org.springframework.ai:spring-ai-client-chat`: affected `<1.0.7 || >=1.1.0-M1, <1.1.6`, fixed in `1.0.7`, `1.1.6` · CVSS 8.2 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation](https://agentprime.io/advisories/GHSA-qqcj-rghw-829x.md) `GHSA-qqcj-rghw-829x`, `CVE-2026-27478` · Maven `io.unitycatalog:unitycatalog-server`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, CWE-346 - [Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer](https://agentprime.io/advisories/GHSA-3jh5-rr2q-xfv7.md) `GHSA-3jh5-rr2q-xfv7`, `CVE-2026-44516` · Maven `com.ritense.valtimo:web`: affected `>=12.4.0, <12.33.0 || >=13.0.0, <13.26.0`, fixed in `12.33.0`, `13.26.0` · CVSS 7.6 High · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs](https://agentprime.io/advisories/GHSA-v632-2m87-7469.md) `GHSA-v632-2m87-7469`, `CVE-2026-41705` · Maven `org.springframework.ai:spring-ai-milvus-store` and 1 more: affected `>=1.0.0, <1.0.7 || >=1.1.0, <1.1.6`, fixed in `1.0.7`, `1.1.6` · CVSS 8.6 High · Not analysed yet · Published 9 May 2026 · Tags: Code injection - [Vert.x has a DoS via unbounded server-side SNI SslContext cache growth](https://agentprime.io/advisories/GHSA-3g76-f9xq-8vp6.md) `GHSA-3g76-f9xq-8vp6`, `CVE-2026-6860` · Maven `io.vertx:vertx-core`: affected `>=4.3.4, <=4.3.8 || >=4.4.0, <=4.4.9 || >=4.5.0, <4.5.27 || >=5.0.0, <5.0.12`, fixed in `4.5.27`, `5.0.12` · CVSS 6.9 Medium · Not analysed yet · Published 9 May 2026 · Tags: Weak cryptography or TLS, Denial of service - [epa4all-client has a VAU Signature bypass](https://agentprime.io/advisories/GHSA-g8r3-5hwf-qp96.md) `GHSA-g8r3-5hwf-qp96`, `CVE-2026-44900` · Maven `com.oviva.telematik:epa4all-client`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 8.1 High · Not analysed yet · Published 8 May 2026 · Tags: Weak cryptography or TLS - [bitcoinj has a ScriptExecution P2PKH/P2WPKH Verification Bypass](https://agentprime.io/advisories/GHSA-hfcf-v2f8-x9pc.md) `GHSA-hfcf-v2f8-x9pc`, `CVE-2026-44714` · Maven `org.bitcoinj:bitcoinj-core`: affected `>=0.15, <0.17.1`, fixed in `0.17.1` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Weak cryptography or TLS - [Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission](https://agentprime.io/advisories/GHSA-2j9m-25xv-mp6r.md) `GHSA-2j9m-25xv-mp6r`, `BIT-nifi-2026-39816`, `CVE-2026-39816` · Maven `org.apache.nifi:nifi-other-graph-services-nar`: affected `>=2.0.0-M1, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Broken access control - [Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption](https://agentprime.io/advisories/GHSA-mx76-r943-rf8g.md) `GHSA-mx76-r943-rf8g`, `CVE-2026-8149` · Maven `org.bouncycastle:bcprov-lts8on`: affected `>=2.73.0, <2.73.11`, fixed in `2.73.11` · CVSS 5.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-354, CWE-1068 - [Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information](https://agentprime.io/advisories/GHSA-rcc6-6q2f-m2cw.md) `GHSA-rcc6-6q2f-m2cw`, `CVE-2023-42344` · Maven `org.opencms:opencms-core`: affected `<10.5.1`, fixed in `10.5.1` · CVSS 7.3 High · Not analysed yet · Published 8 May 2026 · Tags: XML external entities (XXE) - [Alkacon OpenCms is vulnerable to XXE when the \ refers to an external host](https://agentprime.io/advisories/GHSA-pj6p-9p8x-5mfc.md) `GHSA-pj6p-9p8x-5mfc`, `CVE-2023-42346` · Maven `org.opencms:opencms-core`: affected `<16.0`, fixed in `16.0` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: XML external entities (XXE) - [Alkacon OpenCms is vulnerable to XSS via cmis-online/type](https://agentprime.io/advisories/GHSA-8gpv-c454-3hfc.md) `GHSA-8gpv-c454-3hfc`, `CVE-2023-42343` · Maven `org.opencms:opencms-core`: affected `<16.0`, fixed in `16.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS) - [Alkacon OpenCms is vulnerable to XSS via updateModelGroups.jsp](https://agentprime.io/advisories/GHSA-2887-f3v6-6rjf.md) `GHSA-2887-f3v6-6rjf`, `CVE-2023-42345` · Maven `org.opencms:opencms-core`: affected `<16.0`, fixed in `16.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS) - [Spring Cloud Config Server Logged Sensitive Information](https://agentprime.io/advisories/GHSA-j6hh-h3cf-c2hf.md) `GHSA-j6hh-h3cf-c2hf`, `CVE-2026-41004` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `>=3.1.0, <=3.1.13 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.6 || >=4.3.0, <4.3.3 || >=5.0.0, <5.0.3 || >=3.0.0, <=3.0.7`, fixed in `4.3.3`, `5.0.3` · CVSS 4.4 Medium · Not analysed yet · Published 7 May 2026 · Tags: Information disclosure - [Spring Cloud Config Server Susceptible To TOCTOU Attack](https://agentprime.io/advisories/GHSA-86wq-234q-r6wg.md) `GHSA-86wq-234q-r6wg`, `CVE-2026-41002` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `>=3.1.0, <=3.1.13 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.6 || >=4.3.0, <4.3.3 || >=5.0.0, <5.0.3 || >=3.0.0, <=3.0.7`, fixed in `4.3.3`, `5.0.3` · CVSS 7.4 High · Not analysed yet · Published 7 May 2026 · Tags: Race condition - [Spring Cloud Config vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-6g23-24mc-hx6x.md) `GHSA-6g23-24mc-hx6x`, `CVE-2026-40982` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `<=3.1.13 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.6 || >=4.3.0, <4.3.3 || >=5.0.0, <5.0.3`, fixed in `4.3.3`, `5.0.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Path traversal - [Spring Cloud Config has an Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-2mh5-3cw6-hrrq.md) `GHSA-2mh5-3cw6-hrrq`, `CVE-2026-40981` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `>=3.1.0, <=3.1.13 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.6 || >=4.3.0, <4.3.3 || >=5.0.0, <5.0.3`, fixed in `4.3.3`, `5.0.3` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Broken access control, CWE-1220 - [Netty MQTT: Resource exhaustion in MqttDecoder](https://agentprime.io/advisories/GHSA-jfg9-48mv-9qgx.md) `GHSA-jfg9-48mv-9qgx`, `CVE-2026-44248` · Maven `io.netty:netty-codec-mqtt`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Denial of service - [Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect](https://agentprime.io/advisories/GHSA-7j59-v9qr-6fq9.md) `GHSA-7j59-v9qr-6fq9`, `CVE-2026-44503`, `GO-2026-5224`, `PYSEC-2026-2647` · Go `github.com/microsoft/kiota-http-go` and 4 more: affected `<1.5.5`, fixed in `1.5.5` · CVSS 7.0 High · Not analysed yet · Published 7 May 2026 · Tags: Open redirect - [Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS](https://agentprime.io/advisories/GHSA-f6hv-jmp6-3vwv.md) `GHSA-f6hv-jmp6-3vwv`, `CVE-2026-42587` · Maven `io.netty:netty-codec-http` and 1 more: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Denial of service - [Netty Redis Codec Encoder has a CRLF Injection Issue](https://agentprime.io/advisories/GHSA-rgrr-p7gp-5xj7.md) `GHSA-rgrr-p7gp-5xj7`, `CVE-2026-42586` · Maven `io.netty:netty-codec-redis`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 6.8 Medium · Not analysed yet · Published 7 May 2026 · Tags: Other injection - [Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding](https://agentprime.io/advisories/GHSA-38f8-5428-x5cv.md) `GHSA-38f8-5428-x5cv`, `CVE-2026-42585` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: HTTP request smuggling - [Netty has HttpClientCodec response desynchronization](https://agentprime.io/advisories/GHSA-57rv-r2g8-2cj3.md) `GHSA-57rv-r2g8-2cj3`, `CVE-2026-42584` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 7.3 High · Not analysed yet · Published 7 May 2026 · Tags: HTTP request smuggling - [Netty Lz4FrameDecoder is vulnerable to resource exhaustion](https://agentprime.io/advisories/GHSA-mj4r-2hfc-f8p6.md) `GHSA-mj4r-2hfc-f8p6`, `CVE-2026-42583` · Maven `io.netty:netty-codec` and 1 more: affected `<4.1.133.Final`, fixed in `4.1.133.Final` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Denial of service - [Netty HTTP/3 QPACK literal unbounded allocation](https://agentprime.io/advisories/GHSA-2c5c-chwr-9hqw.md) `GHSA-2c5c-chwr-9hqw`, `CVE-2026-42582` · Maven `io.netty:netty-codec-http3`: affected `>=4.2.0.Final, <4.2.13.Final`, fixed in `4.2.13.Final` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Denial of service - [Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization](https://agentprime.io/advisories/GHSA-xxqh-mfjm-7mv9.md) `GHSA-xxqh-mfjm-7mv9`, `CVE-2026-42581` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 5.8 Medium · Not analysed yet · Published 7 May 2026 · Tags: HTTP request smuggling - [Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing](https://agentprime.io/advisories/GHSA-m4cv-j2px-7723.md) `GHSA-m4cv-j2px-7723`, `CVE-2026-42580` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: Memory corruption, HTTP request smuggling - [Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)](https://agentprime.io/advisories/GHSA-cm33-6792-r9fm.md) `GHSA-cm33-6792-r9fm`, `CVE-2026-42579` · Maven `io.netty:netty-codec-dns`: affected `>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final`, fixed in `4.2.13.Final`, `4.1.133.Final` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Denial of service, CWE-20, CWE-626, CWE-1286 - [Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)](https://agentprime.io/advisories/GHSA-45q3-82m4-75jr.md) `GHSA-45q3-82m4-75jr`, `CVE-2026-42578` · Maven `io.netty:netty-handler-proxy`: affected `<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final`, fixed in `4.1.133.Final`, `4.2.13.Final` · CVSS 2.9 Low · Not analysed yet · Published 7 May 2026 · Tags: Other injection - [OpenSearch has ineffective TLS certificate hostname verification](https://agentprime.io/advisories/GHSA-x5hg-x4gv-j98m.md) `GHSA-x5hg-x4gv-j98m` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=2.18.0, <2.19.4.0 || >=3.0.0, <3.3.0.0`, fixed in `2.19.4.0`, `3.3.0.0` · CVSS 2.2 Low · Not analysed yet · Published 7 May 2026 · Tags: Weak cryptography or TLS - [OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation](https://agentprime.io/advisories/GHSA-x83w-23jp-g6pw.md) `GHSA-x83w-23jp-g6pw` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=1.0.0, <2.19.4.0 || >=3.0.0, <3.2.0.0`, fixed in `2.19.4.0`, `3.2.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [OpenSearch vulnerable to improper authorization for Rollover Requests](https://agentprime.io/advisories/GHSA-22vx-2x23-98w6.md) `GHSA-22vx-2x23-98w6` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=1.0.0, <2.19.4.0 || >=3.0.0, <3.2.0.0`, fixed in `2.19.4.0`, `3.2.0.0` · CVSS 2.2 Low · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths](https://agentprime.io/advisories/GHSA-83x9-vc3c-hghc.md) `GHSA-83x9-vc3c-hghc` · Maven `org.opensearch.plugin:opensearch-security`: affected `>=2.11.0.0, <2.19.0.0`, fixed in `2.19.0.0` · CVSS 3.7 Low · Not analysed yet · Published 7 May 2026 · Tags: Broken access control - [Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications](https://agentprime.io/advisories/GHSA-r4w4-wv68-qv85.md) `GHSA-r4w4-wv68-qv85`, `CVE-2026-44308` · Maven `io.awspring.cloud:spring-cloud-aws-sns`: affected `>=4.0.0, <4.0.2 || >=3.0.0, <=3.4.2`, fixed in `4.0.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-345 - [axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification](https://agentprime.io/advisories/GHSA-248h-974q-xrc2.md) `GHSA-248h-974q-xrc2` · Maven `com.getaxonflow:axonflow-sdk`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Weak cryptography or TLS, CWE-345 - [Netty epoll transport denial of service via RST on half-closed TCP connection](https://agentprime.io/advisories/GHSA-rwm7-x88c-3g2p.md) `GHSA-rwm7-x88c-3g2p`, `CVE-2026-42577` · Maven `io.netty:netty-transport-classes-epoll`: affected `>=4.2.0.Final, <4.2.13.Final`, fixed in `4.2.13.Final` · CVSS 7.5 High · Not analysed yet · Published 6 May 2026 · Tags: Denial of service - [Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users](https://agentprime.io/advisories/GHSA-j7j9-5253-f7vh.md) `GHSA-j7j9-5253-f7vh`, `CVE-2026-42555` · Maven `com.ritense.valtimo:case` and 2 more: affected `>=13.0.0, <13.23.0`, fixed in `13.23.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: Code injection - [Micronaut has unbounded \`formattersCache\` in \`TimeConverterRegistrar\` that Allows Memory Exhaustion via \`Accept-Language\` Header](https://agentprime.io/advisories/GHSA-8hjv-92q9-g4xj.md) `GHSA-8hjv-92q9-g4xj`, `CVE-2026-44241` · Maven `io.micronaut:micronaut-context`: affected `>=4.3.0, <4.10.22 || >=3.10.0, <3.10.6 || <3.8.14`, fixed in `4.10.22`, `3.10.6`, `3.8.14` · CVSS 7.5 High · Not analysed yet · Published 6 May 2026 · Tags: Denial of service - [Micronaut has Unbounded \`bundleCache\` in \`ResourceBundleMessageSource\` that Allows Memory Exhaustion via \`Accept-Language\` Header](https://agentprime.io/advisories/GHSA-3rfq-4wpf-qqw3.md) `GHSA-3rfq-4wpf-qqw3`, `CVE-2026-44242` · Maven `io.micronaut:micronaut-inject`: affected `>=4.10.0, <4.10.22 || >=3.10.0, <3.10.6 || <3.8.14`, fixed in `4.10.22`, `3.10.6`, `3.8.14` · CVSS 3.7 Low · Not analysed yet · Published 6 May 2026 · Tags: Denial of service - [Apache Wicket has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability](https://agentprime.io/advisories/GHSA-jvv4-8wxx-m5r6.md) `GHSA-jvv4-8wxx-m5r6`, `CVE-2026-43646` · Maven `org.apache.wicket:wicket-parent`: affected `>=8.0.0-M1, <=8.17.0 || >=9.0.0-M1, <=9.22.0 || >=10.0.0-M1, <10.9.0`, fixed in `10.9.0` · CVSS 7.5 High · Not analysed yet · Published 6 May 2026 · Tags: Information disclosure - [Apache Wicket has a Path Traversal issue](https://agentprime.io/advisories/GHSA-3gmf-p6r4-q8m6.md) `GHSA-3gmf-p6r4-q8m6`, `CVE-2026-43975` · Maven `org.apache.wicket:wicket-core`: affected `>=8.0.0-M1, <=8.17.0 || >=9.0.0-M1, <=9.22.0 || >=10.0.0-M1, <10.9.0`, fixed in `10.9.0` · CVSS 6.5 Medium · Not analysed yet · Published 6 May 2026 · Tags: Path traversal - [Apache Wicket has a Session Fixation issue](https://agentprime.io/advisories/GHSA-qpjw-p3jg-59j6.md) `GHSA-qpjw-p3jg-59j6`, `CVE-2026-40010` · Maven `org.apache.wicket:wicket-auth-roles`: affected `>=8.0.0-M1, <=8.17.0 || >=9.0.0-M1, <=9.22.0 || >=10.0.0-M1, <10.9.0`, fixed in `10.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: Authentication bypass - [Apache Wicket has a Cross-site Scripting issue](https://agentprime.io/advisories/GHSA-5x9h-93gp-chpj.md) `GHSA-5x9h-93gp-chpj`, `CVE-2026-42509` · Maven `org.apache.wicket:wicket-parent`: affected `>=8.0.0-M1, <=8.17.0 || >=9.0.0-M1, <=9.22.0 || >=10.0.0-M1, <10.9.0`, fixed in `10.9.0` · CVSS 6.1 Medium · Not analysed yet · Published 6 May 2026 · Tags: Cross-site scripting (XSS) - [ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases](https://agentprime.io/advisories/GHSA-fxc7-fm93-6q77.md) `GHSA-fxc7-fm93-6q77`, `CVE-2026-44221` · Maven `com.arcadedb:arcadedb-server`: affected `>=21.10.1, <26.4.2`, fixed in `26.4.2` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Broken access control - [jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine](https://agentprime.io/advisories/GHSA-mggx-p7jf-jgw4.md) `GHSA-mggx-p7jf-jgw4` · Maven `org.jdbi:jdbi3-freemarker`: affected `<3.53.0`, fixed in `3.53.0` · CVSS 4.0, no score published · Not analysed yet · Published 5 May 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .