# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation](https://agentprime.io/advisories/GHSA-9wm7-8qf3-9v98.md)
  `GHSA-9wm7-8qf3-9v98`, `CVE-2026-48923` · Maven `com.rapid7:jenkinsci-appspider-plugin`: affected `<1.0.18`, fixed in `1.0.18` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation
- [Jenkins LDAP Plugin deserializes data from LDAP referrals without validation](https://agentprime.io/advisories/GHSA-x9v8-p946-5pwc.md)
  `GHSA-x9v8-p946-5pwc`, `CVE-2026-48917` · Maven `org.jenkins-ci.plugins:ldap`: affected `<807.809.vd3a`, fixed in `807.809.vd3a` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization
- [Jenkins Active Directory Plugin follows LDAP referrals by default](https://agentprime.io/advisories/GHSA-wrhr-54p6-q97f.md)
  `GHSA-wrhr-54p6-q97f`, `CVE-2026-48918` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.1`, fixed in `2.41.1` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries](https://agentprime.io/advisories/GHSA-qjq3-wqj5-g37q.md)
  `GHSA-qjq3-wqj5-g37q`, `CVE-2026-48921` · Maven `io.jenkins.plugins:pipeline-groovy-lib`: affected `<798.v5cc688825312`, fixed in `798.v5cc688825312` · CVSS 7.5 High · Not analysed yet · Published 27 May 2026 · Tags: Path traversal
- [Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation](https://agentprime.io/advisories/GHSA-p2gw-f3rv-82mw.md)
  `GHSA-p2gw-f3rv-82mw`, `CVE-2026-48919` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.1`, fixed in `2.41.1` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Insecure deserialization
- [Jenkins Email Extension Plugin: Attackers able to control email content may specify \`file:\` URLs for images to read arbitrary files from Jenkins controller filesystem](https://agentprime.io/advisories/GHSA-mq58-m26g-46gp.md)
  `GHSA-mq58-m26g-46gp`, `CVE-2026-48920` · Maven `org.jenkins-ci.plugins:email-ext`: affected `<1933.1935.v276319e3cc47`, fixed in `1933.1935.v276319e3cc47` · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Path traversal
- [Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials](https://agentprime.io/advisories/GHSA-fxxf-w25w-mcx2.md)
  `GHSA-fxxf-w25w-mcx2`, `CVE-2026-48922` · Maven `org.jenkins-ci.plugins:credentials-binding`: affected `<725.ve52b`, fixed in `725.ve52b` · CVSS 7.5 High · Not analysed yet · Published 27 May 2026 · Tags: Path traversal, CWE-20
- [Jenkins LDAP Plugin follows LDAP referrals](https://agentprime.io/advisories/GHSA-fmjp-mw89-c6h6.md)
  `GHSA-fmjp-mw89-c6h6`, `CVE-2026-48916` · Maven `org.jenkins-ci.plugins:ldap`: affected `<807.809.vd3a`, fixed in `807.809.vd3a` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Keycloak Vulnerable to Improper Validation of Specified Quantity in Input](https://agentprime.io/advisories/GHSA-rr5q-3xwr-f323.md)
  `GHSA-rr5q-3xwr-f323`, `CVE-2026-9704` · Maven `org.keycloak:keycloak-server-spi-private` and 1 more: affected `<26.6.3`, fixed in `26.6.3` · CVSS 6.8 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-1284
- [Keycloak Services has Improper Validation of Consistency within Input](https://agentprime.io/advisories/GHSA-wcvj-vpvw-9rr5.md)
  `GHSA-wcvj-vpvw-9rr5`, `CVE-2026-9689` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <=26.6.4 || <=26.4.7`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-1288
- [Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in \`JavaExprAlgorithmExecutionFactory\`](https://agentprime.io/advisories/GHSA-524g-x36v-9wm6.md)
  `GHSA-524g-x36v-9wm6`, `CVE-2026-44632` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection
- [Yamcs has No Rate Limiting on Authentication Endpoint](https://agentprime.io/advisories/GHSA-w5r6-mcgq-7pq4.md)
  `GHSA-w5r6-mcgq-7pq4`, `CVE-2026-44596` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: Authentication bypass
- [Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints](https://agentprime.io/advisories/GHSA-p2rj-mrmc-9w29.md)
  `GHSA-p2rj-mrmc-9w29`, `CVE-2026-44595` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Broken access control
- [Yamcs Vulnerable to LDAP Injection in LdapAuthModule](https://agentprime.io/advisories/GHSA-cqh3-jg8p-336j.md)
  `GHSA-cqh3-jg8p-336j`, `CVE-2026-42568` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection
- [netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte\[\] on failures](https://agentprime.io/advisories/GHSA-f659-372h-6x3x.md)
  `GHSA-f659-372h-6x3x`, `CVE-2026-41207` · Maven `io.netty.incubator:netty-incubator-codec-ohttp`: affected `<0.0.21.Final`, fixed in `0.0.21.Final` · CVSS 6.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Weak cryptography or TLS
- [XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests](https://agentprime.io/advisories/GHSA-rh28-mqj4-8x59.md)
  `GHSA-rh28-mqj4-8x59`, `CVE-2026-48048` · Maven `org.xwiki.platform:xwiki-platform-livetable-ui`: affected `>=6.2.1, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0-rc-1, <17.10.3`, fixed in `16.10.17`, `17.4.9`, `17.10.3` · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: Information disclosure
- [XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin](https://agentprime.io/advisories/GHSA-vgwr-23fq-pr7g.md)
  `GHSA-vgwr-23fq-pr7g`, `CVE-2026-48047` · Maven `org.xwiki.platform:xwiki-platform-webjars-api`: affected `>=9.6-rc-1, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0-rc-1, <17.10.3`, fixed in `16.10.17`, `17.4.9`, `17.10.3` · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Path traversal
- [XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}](https://agentprime.io/advisories/GHSA-qrvh-r3f2-9h4r.md)
  `GHSA-qrvh-r3f2-9h4r`, `CVE-2026-33137` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=15.10.6, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0, <17.10.3 || >=18.0.0-rc-1, <18.1.0-rc-1`, fixed in `16.10.17`, `17.4.9`, `17.10.3`, `18.1.0-rc-1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Broken access control
- [XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash](https://agentprime.io/advisories/GHSA-xq3r-2qv5-vqqm.md)
  `GHSA-xq3r-2qv5-vqqm`, `CVE-2026-23734` · Maven `org.xwiki.commons:xwiki-commons-classloader-api`: affected `>=4.2-milestone-2, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0, <17.10.3 || >=18.0.0-rc-1, <18.1.0-rc-1`, fixed in `16.10.17`, `17.4.9`, `17.10.3`, `18.1.0-rc-1` · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 26 May 2026 · Tags: Path traversal
- [Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-wpqm-4gwx-w843.md)
  `GHSA-wpqm-4gwx-w843`, `CVE-2026-44598` · Maven `org.apache.shiro:shiro-jakarta-ee`: affected `>=2.0.0-alpha-0, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2`, fixed in `2.2.0`, `3.0.0-alpha-2` · CVSS 5.1 Medium · Not analysed yet · Published 26 May 2026 · Tags: Open redirect, Server-side request forgery (SSRF)
- [Apache Shiro has a session fixation vulnerability](https://agentprime.io/advisories/GHSA-fcvm-3cpj-f9qx.md)
  `GHSA-fcvm-3cpj-f9qx`, `CVE-2026-43827` · Maven `org.apache.shiro:shiro-core`: affected `>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2`, fixed in `2.2.0`, `3.0.0-alpha-2` · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass
- [Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute](https://agentprime.io/advisories/GHSA-c6r4-qjmw-cvj2.md)
  `GHSA-c6r4-qjmw-cvj2`, `CVE-2026-43828` · Maven `org.apache.shiro:shiro-web`: affected `>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2`, fixed in `2.2.0`, `3.0.0-alpha-2` · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-614
- [Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login](https://agentprime.io/advisories/GHSA-7pq2-fhx9-x464.md)
  `GHSA-7pq2-fhx9-x464`, `CVE-2026-48589` · Maven `org.apache.shiro:shiro-jakarta-ee`: affected `>=2.0-alpha, <2.2.1 || >=3.0.0-alpha-0, <3.0.0-alpha-2`, fixed in `2.2.1`, `3.0.0-alpha-2` · CVSS 0.0 None · Not analysed yet · Published 26 May 2026 · Tags: Open redirect
- [TCC-TRANSACTION has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-4r4v-3jc5-hrg9.md)
  `GHSA-4r4v-3jc5-hrg9`, `CVE-2026-9497` · Maven `org.mengyun:tcc-transaction`: affected `<=2.1.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Insecure deserialization, CWE-20
- [Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries](https://agentprime.io/advisories/GHSA-vr35-jm2f-8wg2.md)
  `GHSA-vr35-jm2f-8wg2`, `CVE-2026-42797` · Maven `org.apache.syncope.core:syncope-core-provisioning-api`: affected `>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1`, fixed in `4.0.6`, `4.1.1` · CVSS 4.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-202
- [Apache Syncope has an Improper Isolation or Compartmentalization vulnerability](https://agentprime.io/advisories/GHSA-gq7g-vg2q-jvq3.md)
  `GHSA-gq7g-vg2q-jvq3`, `CVE-2026-42782` · Maven `org.apache.syncope.core:syncope-core-spring`: affected `>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1`, fixed in `4.0.6`, `4.1.1` · CVSS 7.2 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-653
- [Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk](https://agentprime.io/advisories/GHSA-cc4m-mp48-x7qg.md)
  `GHSA-cc4m-mp48-x7qg`, `CVE-2026-41863` · Maven `org.springframework.ai:spring-ai-anthropic`: affected `>=1.1.0, <1.1.7`, fixed in `1.1.7` · CVSS 6.5 Medium · Not analysed yet · Published 26 May 2026 · Tags: Path traversal
- [jasypt-spring-boot Uses a One-Way Hash without a Salt](https://agentprime.io/advisories/GHSA-jgj7-c8vj-w563.md)
  `GHSA-jgj7-c8vj-w563`, `CVE-2026-9370` · Maven `com.github.ulisesbocchio:jasypt-spring-boot` and 1 more: affected `>=3.0.0, <=4.0.4`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-759, CWE-760
- [Apache CXF has an LDAP injection vulnerability](https://agentprime.io/advisories/GHSA-pg32-686q-qh6x.md)
  `GHSA-pg32-686q-qh6x`, `CVE-2026-44930` · Maven `org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap`: affected `>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11`, fixed in `4.2.1`, `4.1.6`, `3.6.11` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Other injection
- [Apache CXF's WS-Transfer module has an insecure XML parser configuration](https://agentprime.io/advisories/GHSA-vmm5-fjgx-2jhp.md)
  `GHSA-vmm5-fjgx-2jhp`, `CVE-2026-44618` · Maven `org.apache.cxf:cxf-rt-ws-transfer`: affected `>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11`, fixed in `4.2.1`, `4.1.6`, `3.6.11` · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: XML external entities (XXE)
- [Apache CXF: Untrusted JMS configuration can lead to RCE](https://agentprime.io/advisories/GHSA-2hvc-5c6v-f533.md)
  `GHSA-2hvc-5c6v-f533`, `CVE-2026-44417` · Maven `org.apache.cxf:cxf-rt-transports-jms`: affected `>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11`, fixed in `4.2.1`, `4.1.6`, `3.6.11` · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-15, CWE-20
- [OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users](https://agentprime.io/advisories/GHSA-9vmh-whc4-7phg.md)
  `GHSA-9vmh-whc4-7phg`, `CVE-2026-46481` · Maven `org.open-metadata:openmetadata-service`: affected `<1.12.4`, fixed in `1.12.4` · CVSS 8.3 High · Not analysed yet · Published 21 May 2026 · Tags: Information disclosure
- [Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise](https://agentprime.io/advisories/GHSA-m6qj-3mpp-57v8.md)
  `GHSA-m6qj-3mpp-57v8`, `CVE-2026-9087` · Maven `org.keycloak:keycloak-services`: affected `<26.6.3`, fixed in `26.6.3` · CVSS 6.4 Medium · Not analysed yet · Published 20 May 2026 · Tags: Broken access control
- [Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service](https://agentprime.io/advisories/GHSA-7xpr-hc2w-34m9.md)
  `GHSA-7xpr-hc2w-34m9`, `CVE-2026-45799` · Maven `com.squareup.wire:wire-runtime` and 1 more: affected `<6.3.0 || >=7.0.0-alpha01, <7.0.0-alpha03`, fixed in `6.3.0`, `7.0.0-alpha03` · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-129
- [Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)](https://agentprime.io/advisories/GHSA-9wxq-mwqw-8hhg.md)
  `GHSA-9wxq-mwqw-8hhg`, `CVE-2026-6009` · Maven `net.sf.jasperreports:jasperreports`: affected `<7.0.7`, fixed in `7.0.7` · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: Insecure deserialization
- [ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation](https://agentprime.io/advisories/GHSA-xm96-gfjx-jcrc.md)
  `GHSA-xm96-gfjx-jcrc` · Maven `land.oras:oras-java-sdk`: affected `<0.6.2`, fixed in `0.6.2` · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: Path traversal
- [fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode](https://agentprime.io/advisories/GHSA-wg5x-3g47-v38r.md)
  `GHSA-wg5x-3g47-v38r`, `CVE-2026-45581` · Maven `org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim`: affected `>=2.3.1, <2.5.10`, fixed in `2.5.10` · CVSS 5.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure
- [GlassFish's Administration Console is Vulnerable to RCE](https://agentprime.io/advisories/GHSA-96v6-hq43-x9h4.md)
  `GHSA-96v6-hq43-x9h4`, `CVE-2026-2586` · Maven `org.glassfish.jsftemplating:jsftemplating` and 1 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Code injection
- [GlassFish's gadget handler is vulnerable to RCE](https://agentprime.io/advisories/GHSA-29wv-cv7p-xjc2.md)
  `GHSA-29wv-cv7p-xjc2`, `CVE-2026-2587` · Maven `org.glassfish.jsftemplating:jsftemplating` and 1 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Code injection
- [Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering](https://agentprime.io/advisories/GHSA-8364-hfqj-pwm6.md)
  `GHSA-8364-hfqj-pwm6`, `CVE-2026-47323` · Maven `org.apache.camel:camel-cxf-rest`: affected `>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2`, fixed in `4.14.6`, `4.18.2` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 19 May 2026 · Tags: CWE-178, CWE-791
- [Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak](https://agentprime.io/advisories/GHSA-rp95-xpg9-c2cq.md)
  `GHSA-rp95-xpg9-c2cq`, `BIT-keycloak-2026-7504`, `CVE-2026-7504` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: Open redirect
- [Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-j8mx-j73w-9mxw.md)
  `GHSA-j8mx-j73w-9mxw`, `CVE-2026-7860` · Maven `com.vaadin:flow-gradle-plugin` and 2 more: affected `>=24.0.0, <24.9.18 || >=24.10.0, <24.10.4 || >=25.0.0, <25.0.12 || >=25.1.0, <25.1.5`, fixed in `24.9.18`, `24.10.4`, `25.0.12`, `25.1.5` · CVSS 1.6 Low · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure
- [Keycloak: Access token disclosure and implicit flow bypass via forged client data](https://agentprime.io/advisories/GHSA-hq3p-w4xv-x7vp.md)
  `GHSA-hq3p-w4xv-x7vp`, `BIT-keycloak-2026-7571`, `CVE-2026-7571` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 7.1 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-472
- [Keycloak: Session fixation in OIDC login flow that can lead to account takeover](https://agentprime.io/advisories/GHSA-hf67-5vvq-fm3r.md)
  `GHSA-hf67-5vvq-fm3r`, `BIT-keycloak-2026-7507`, `CVE-2026-7507` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Keycloak: Denial of Service via specially crafted SAML input](https://agentprime.io/advisories/GHSA-p5mv-gj8j-xqgf.md)
  `GHSA-p5mv-gj8j-xqgf`, `BIT-keycloak-2026-7307`, `CVE-2026-7307` · Maven `org.keycloak:keycloak-saml-core`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-1286
- [Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers](https://agentprime.io/advisories/GHSA-c739-f6xw-6pv2.md)
  `GHSA-c739-f6xw-6pv2`, `BIT-keycloak-2026-4630`, `CVE-2026-4630` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 6.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control
- [Keycloak: Unauthorized account takeover via WebAuthn token replay](https://agentprime.io/advisories/GHSA-w4p5-rfh6-cwrv.md)
  `GHSA-w4p5-rfh6-cwrv`, `BIT-keycloak-2026-37982`, `CVE-2026-37982` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 6.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Keycloak Account Resources user lookup contains broken access control](https://agentprime.io/advisories/GHSA-933f-rg6j-f46p.md)
  `GHSA-933f-rg6j-f46p`, `BIT-keycloak-2026-37981`, `CVE-2026-37981` · Maven `org.keycloak:keycloak-services`: affected `<26.4.12 || >=26.5.0, <26.6.2`, fixed in `26.4.12`, `26.6.2` · CVSS 4.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-1220
- [Keycloak: Information Disclosure via evaluate-scopes Admin API](https://agentprime.io/advisories/GHSA-rrv7-3mqf-hxfr.md)
  `GHSA-rrv7-3mqf-hxfr`, `BIT-keycloak-2026-37978`, `CVE-2026-37978` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 4.9 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control
- [Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass](https://agentprime.io/advisories/GHSA-4x37-hw65-52w8.md)
  `GHSA-4x37-hw65-52w8`, `BIT-keycloak-2026-37979`, `CVE-2026-37979` · Maven `org.keycloak:keycloak-services`: affected `<26.6.2`, fixed in `26.6.2` · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control
- [Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level \`notBefore\` Revocation Policies are Configured](https://agentprime.io/advisories/GHSA-83c4-ffjp-mxp9.md)
  `GHSA-83c4-ffjp-mxp9`, `CVE-2026-8922` · Maven `org.keycloak:keycloak-services`: affected `<=26.6.2`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 19 May 2026 · Tags: Authentication bypass
- [Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation](https://agentprime.io/advisories/GHSA-g8vr-x4qh-25qg.md)
  `GHSA-g8vr-x4qh-25qg`, `CVE-2026-8830` · Maven `org.keycloak:keycloak-services`: affected `<26.6.3`, fixed in `26.6.3` · CVSS 4.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-603
- [HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint](https://agentprime.io/advisories/GHSA-3653-68v6-rq57.md)
  `GHSA-3653-68v6-rq57`, `CVE-2026-45367` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` and 7 more: affected `<6.9.7`, fixed in `6.9.7` · CVSS 7.5 High · Not analysed yet · Published 18 May 2026 · Tags: Denial of service
- [async-http-client: Cookie header not stripped on cross-origin redirect](https://agentprime.io/advisories/GHSA-fmxf-pm6p-7xgm.md)
  `GHSA-fmxf-pm6p-7xgm`, `CVE-2026-45300` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0.Beta1, <3.0.10 || >=2.0.0, <2.15.0`, fixed in `3.0.10`, `2.15.0` · CVSS 7.4 High · Not analysed yet · Published 18 May 2026 · Tags: Information disclosure
- [Spring AI MCP Security: Unvalidated URL Fetching (SSRF)](https://agentprime.io/advisories/GHSA-qjp4-4jvr-xqg3.md)
  `GHSA-qjp4-4jvr-xqg3`, `CVE-2026-45609` · Maven `org.springaicommunity:mcp-client-security`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.2 High · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF)
- [org.linlinjava:litemall-wx-api has an Injection issue](https://agentprime.io/advisories/GHSA-cvwm-vwhp-22jx.md)
  `GHSA-cvwm-vwhp-22jx`, `CVE-2026-8771` · Maven `org.linlinjava:litemall-wx-api`: affected `<=0.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 18 May 2026 · Tags: Other injection, SQL injection
- [Beetl's SpELFunction extension function has an expression injection risk](https://agentprime.io/advisories/GHSA-fmmw-44rp-jcfp.md)
  `GHSA-fmmw-44rp-jcfp`, `CVE-2026-8759` · Maven `com.ibeetl:beetl-spring-classic`: affected `<=3.20.2.RELEASE`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: Code injection, CWE-20
- [Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client](https://agentprime.io/advisories/GHSA-gqx7-6552-67hf.md)
  `GHSA-gqx7-6552-67hf`, `CVE-2026-45575` · Maven `com.oviva.telematik:epa4all-client`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 7.4 High · Not analysed yet · Published 15 May 2026 · Tags: Weak cryptography or TLS
- [Apache Flink: Remote code execution via SQL injection in code generation](https://agentprime.io/advisories/GHSA-2f54-v4hm-fx73.md)
  `GHSA-2f54-v4hm-fx73`, `BIT-flink-2026-35194`, `CVE-2026-35194` · Maven `org.apache.flink:flink-table-api-java` and 2 more: affected `>=1.15.0, <1.20.4 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.2 || >=2.2.0, <2.2.1`, fixed in `1.20.4`, `2.0.2`, `2.1.2`, `2.2.1` · CVSS 8.1 High · Not analysed yet · Published 15 May 2026 · Tags: Code injection
- [epa4all-client: TLS Certificate Validation Disabled in Production](https://agentprime.io/advisories/GHSA-5hhf-xmfx-4vvr.md)
  `GHSA-5hhf-xmfx-4vvr`, `CVE-2026-45574` · Maven `com.oviva.telematik:epa4all-client`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 8.1 High · Not analysed yet · Published 15 May 2026 · Tags: Weak cryptography or TLS

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA1LTE1VDE4OjI5OjMxLjAwMDAwMFoiLCJHSFNBLTVoaGYteG1meC00dnZyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA1LTI3VDE1OjMzOjI3LjAwMDAwMFoiLCJHSFNBLXA4amgtNHA1cC0ycmZwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA1LTI3VDE1OjMzOjI3LjAwMDAwMFoiLCJHSFNBLXA4amgtNHA1cC0ycmZwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.