# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Spring HATEOAS heap exhaustion through unbounded internal caching](https://agentprime.io/advisories/GHSA-439x-6767-44cv.md)
  `GHSA-439x-6767-44cv`, `CVE-2026-41007` · Maven `org.springframework.hateoas:spring-hateoas`: affected `>=3.0.0, <3.0.4 || >=2.5.0, <2.5.3 || >=2.3.0, <=2.3.4 || <=1.5.6 || >=2.4.0, <=2.4.1`, fixed in `3.0.4`, `2.5.3` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring Framework Cross-site Scripting via JavaScriptUtils](https://agentprime.io/advisories/GHSA-3chg-m5w7-qfv5.md)
  `GHSA-3chg-m5w7-qfv5`, `CVE-2026-41845` · Maven `org.springframework:spring-webmvc`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service](https://agentprime.io/advisories/GHSA-2827-2mxx-j8pv.md)
  `GHSA-2827-2mxx-j8pv`, `CVE-2026-41710` · Maven `org.springframework.retry:spring-retry`: affected `>=2.0.0, <2.0.13 || <=1.3.4`, fixed in `2.0.13` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Micrometer gRPC server instrumentation DoS](https://agentprime.io/advisories/GHSA-w737-wx49-qj23.md)
  `GHSA-w737-wx49-qj23`, `CVE-2026-40983` · Maven `io.micrometer:micrometer-core`: affected `>=1.16.0, <1.16.6 || >=1.15.0, <1.15.12`, fixed in `1.16.6`, `1.15.12` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Micrometer HTTP server instrumentations DoS](https://agentprime.io/advisories/GHSA-g3pr-3p32-fp23.md)
  `GHSA-g3pr-3p32-fp23`, `CVE-2026-40984` · Maven `io.micrometer:micrometer-core` and 2 more: affected `>=1.16.0, <1.16.6 || >=1.15.0, <1.15.12 || >=1.14.0, <=1.14.14 || >=1.10.0, <=1.13.15 || <=1.9.17`, fixed in `1.16.6`, `1.15.12` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Netty has Insufficient Bailiwick Validation for NS Records](https://agentprime.io/advisories/GHSA-5pvg-856g-cp85.md)
  `GHSA-5pvg-856g-cp85`, `CVE-2026-47691` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced](https://agentprime.io/advisories/GHSA-5x3r-wrvg-rp6q.md)
  `GHSA-5x3r-wrvg-rp6q`, `CVE-2026-47244` · Maven `io.netty:netty-codec-http2`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Netty: SCTP reassembly nests buffers without bound](https://agentprime.io/advisories/GHSA-5xrh-qmmq-w6ch.md)
  `GHSA-5xrh-qmmq-w6ch`, `CVE-2026-46340` · Maven `io.netty:netty-transport-sctp`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records](https://agentprime.io/advisories/GHSA-676x-f7gg-47vc.md)
  `GHSA-676x-f7gg-47vc`, `CVE-2026-45674` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port](https://agentprime.io/advisories/GHSA-xmv7-r254-6q78.md)
  `GHSA-xmv7-r254-6q78`, `CVE-2026-45673` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 6.8 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Netty: Unix-socket fd receive leaks descriptors when peer sends two at once](https://agentprime.io/advisories/GHSA-w573-9ffj-6ff9.md)
  `GHSA-w573-9ffj-6ff9`, `CVE-2026-45536` · Maven `io.netty:netty-transport-native-epoll` and 1 more: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 4.0 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Information disclosure, Denial of service
- [Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes](https://agentprime.io/advisories/GHSA-x4gw-5cx5-pgmh.md)
  `GHSA-x4gw-5cx5-pgmh`, `CVE-2026-45416` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Netty's Default QUIC token handler accepts any client-supplied token](https://agentprime.io/advisories/GHSA-cmm3-54f8-px4j.md)
  `GHSA-cmm3-54f8-px4j`, `CVE-2026-44894` · Maven `io.netty:netty-codec-classes-quic`: affected `>=4.2.0.Final, <4.2.15.Final`, fixed in `4.2.15.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-346, CWE-940
- [Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length](https://agentprime.io/advisories/GHSA-cc37-9q2j-3hfv.md)
  `GHSA-cc37-9q2j-3hfv`, `CVE-2026-44893` · Maven `io.netty:netty-codec-haproxy`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Memory corruption, CWE-703
- [Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size](https://agentprime.io/advisories/GHSA-c2rx-5r8w-8xr2.md)
  `GHSA-c2rx-5r8w-8xr2`, `CVE-2026-44892` · Maven `io.netty:netty-codec-http3`: affected `>=4.2.0.Final, <4.2.15.Final`, fixed in `4.2.15.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service, CWE-1188
- [Netty has Unbounded Direct Memory Consumption in its RedisDecoder](https://agentprime.io/advisories/GHSA-6ghj-frrj-jjj3.md)
  `GHSA-6ghj-frrj-jjj3`, `CVE-2026-44890` · Maven `io.netty:netty-codec-redis`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays](https://agentprime.io/advisories/GHSA-3244-j874-rhc2.md)
  `GHSA-3244-j874-rhc2`, `CVE-2026-44250` · Maven `io.netty:netty-codec-redis`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service
- [Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking](https://agentprime.io/advisories/GHSA-3qp7-7mw8-wx86.md)
  `GHSA-3qp7-7mw8-wx86`, `CVE-2026-44249` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Broken access control, CWE-697, CWE-1287
- [hsweb-framework has an open redirect issue](https://agentprime.io/advisories/GHSA-fxr3-gvm4-m8vc.md)
  `GHSA-fxr3-gvm4-m8vc`, `CVE-2026-11477` · Maven `org.hswebframework.web:hsweb-authorization-oauth2`: affected `<=5.0.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Open redirect
- [hsweb-framework has a Path Traversal issue](https://agentprime.io/advisories/GHSA-vjmr-f5fc-vr2w.md)
  `GHSA-vjmr-f5fc-vr2w`, `CVE-2026-11470` · Maven `org.hswebframework.web:hsweb-system-file`: affected `<=5.0.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Path traversal
- [Keycloak: Information disclosure due to user profile permission bypass](https://agentprime.io/advisories/GHSA-6g26-7cx5-mrrg.md)
  `GHSA-6g26-7cx5-mrrg`, `CVE-2026-9088` · Maven `org.keycloak:keycloak-services`: affected `<26.7.0`, fixed in `26.7.0` · CVSS 2.7 Low · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-1220
- [Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path](https://agentprime.io/advisories/GHSA-8f39-v287-78jf.md)
  `GHSA-8f39-v287-78jf`, `CVE-2026-50076` · Maven `org.apache.fory:fory-core`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Insecure deserialization
- [epa4all-client: Unauthenticated REST API for Patient Record Writes](https://agentprime.io/advisories/GHSA-c82x-f4xr-qv33.md)
  `GHSA-c82x-f4xr-qv33`, `CVE-2026-47672` · Maven `com.oviva.telematik:epa4all-rest-service`: affected `<=1.2.4`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Authentication bypass
- [Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass](https://agentprime.io/advisories/GHSA-v3pr-hxpr-mfm8.md)
  `GHSA-v3pr-hxpr-mfm8`, `CVE-2026-47065` · Maven `org.apache.mina:mina-core`: affected `>=2.2.0, <2.2.8 || >=2.1.0, <2.1.13 || <2.0.29`, fixed in `2.2.8`, `2.1.13`, `2.0.29` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2026 · Tags: Insecure deserialization
- [Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes](https://agentprime.io/advisories/GHSA-c2rv-hwqm-wjpg.md)
  `GHSA-c2rv-hwqm-wjpg`, `CVE-2026-46718` · Maven `org.apache.calcite:calcite-core`: affected `>=1.5.0, <1.42.0`, fixed in `1.42.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Code injection
- [Spring Cloud Function Context has Uncontrolled Recursion](https://agentprime.io/advisories/GHSA-x9c7-5h6g-hq8q.md)
  `GHSA-x9c7-5h6g-hq8q`, `CVE-2026-40989` · Maven `org.springframework.cloud:spring-cloud-function-context`: affected `>=4.3.0, <4.3.3 || >=5.0.0, <5.0.2 || >=3.2.10, <=3.2.15 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.5`, fixed in `4.3.3`, `5.0.2` · CVSS 5.7 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Denial of service
- [Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry](https://agentprime.io/advisories/GHSA-x4h3-g2x4-8gqv.md)
  `GHSA-x4h3-g2x4-8gqv`, `CVE-2026-40990` · Maven `org.springframework.cloud:spring-cloud-function-context`: affected `>=4.3.0, <4.3.3 || >=5.0.0, <5.0.2 || >=3.2.10, <=3.2.15 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.5`, fixed in `4.3.3`, `5.0.2` · CVSS 5.7 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Denial of service
- [Logback vulnerable to Object Injection through HardenedObjectInputStream modules](https://agentprime.io/advisories/GHSA-jhq6-gfmj-v8fx.md)
  `GHSA-jhq6-gfmj-v8fx`, `CVE-2026-10532` · Maven `ch.qos.logback:logback-core`: affected `<1.5.34`, fixed in `1.5.34` · CVSS 2.9 Low · Not analysed yet · Published 1 Jun 2026 · Tags: Insecure deserialization
- [Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component](https://agentprime.io/advisories/GHSA-vqc2-c9jh-3jjv.md)
  `GHSA-vqc2-c9jh-3jjv`, `CVE-2026-49328` · Maven `org.apache.fesod:fesod-sheet`: affected `<2.0.2-incubating`, fixed in `2.0.2-incubating` · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF)
- [Apache MINA SSHD bundle sshd-git has a path traversal vulnerability](https://agentprime.io/advisories/GHSA-mw4m-qhpg-j82m.md)
  `GHSA-mw4m-qhpg-j82m`, `CVE-2026-48827` · Maven `org.apache.sshd:sshd-git`: affected `<2.18.0 || >=3.0.0-M1, <3.0.0-M4`, fixed in `2.18.0`, `3.0.0-M4` · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Path traversal
- [Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability](https://agentprime.io/advisories/GHSA-hf52-78x8-6w3w.md)
  `GHSA-hf52-78x8-6w3w`, `BIT-activemq-2026-49270`, `CVE-2026-49270` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 5.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-1230
- [Apache ActiveMQ server has an incomplete authorization workflow](https://agentprime.io/advisories/GHSA-cpw7-g3p5-qrfq.md)
  `GHSA-cpw7-g3p5-qrfq`, `BIT-activemq-2026-46605`, `CVE-2026-46605` · Maven `org.apache.activemq:apache-activemq`: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Broken access control
- [Apache ActiveMQ has an Incorrect Default Permissions vulnerability](https://agentprime.io/advisories/GHSA-99qx-5qqr-4j95.md)
  `GHSA-99qx-5qqr-4j95`, `BIT-activemq-2026-49157`, `CVE-2026-49157` · Maven `org.apache.activemq:apache-activemq`: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Broken access control
- [Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer](https://agentprime.io/advisories/GHSA-4c39-fwgj-4vq7.md)
  `GHSA-4c39-fwgj-4vq7`, `CVE-2026-49361` · Maven `org.apache.fluss:fluss-common`: affected `>=0.8.0-incubating-rc1, <0.9.1-incubating`, fixed in `0.9.1-incubating` · CVSS 7.5 High · Not analysed yet · Published 1 Jun 2026 · Tags: Denial of service
- [Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue](https://agentprime.io/advisories/GHSA-v853-w46p-fv2h.md)
  `GHSA-v853-w46p-fv2h`, `BIT-activemq-2026-45505`, `CVE-2026-45505` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection, CWE-20
- [Apache Solr has hardcoded credentials in the Basic Authentication setup tool](https://agentprime.io/advisories/GHSA-qhr7-h655-pw6r.md)
  `GHSA-qhr7-h655-pw6r`, `BIT-solr-2026-44825`, `CVE-2026-44825` · Maven `org.apache.solr:solr-core`: affected `>=9.4.0, <=9.10.1`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Hard-coded credentials, CWE-1188
- [Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue](https://agentprime.io/advisories/GHSA-hg6c-8mvr-jqc9.md)
  `GHSA-hg6c-8mvr-jqc9`, `BIT-activemq-2026-42588`, `CVE-2026-42588` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection, CWE-20
- [Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue](https://agentprime.io/advisories/GHSA-8wm6-6fqh-phmc.md)
  `GHSA-8wm6-6fqh-phmc`, `BIT-activemq-2026-42253`, `CVE-2026-42253` · Maven `org.apache.activemq:activemq-web` and 1 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 6.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Apache Directory LDAP API lacks server certificate verification for LDAP hostnames](https://agentprime.io/advisories/GHSA-85rw-g4f4-jprr.md)
  `GHSA-85rw-g4f4-jprr`, `CVE-2026-35563` · Maven `org.apache.directory.api:api-ldap-client-api`: affected `>=2.0.0, <2.1.8`, fixed in `2.1.8` · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Weak cryptography or TLS
- [CC-Tweaked has an SSRF Protection Bypass with NAT64](https://agentprime.io/advisories/GHSA-5jh9-2h63-pw4q.md)
  `GHSA-5jh9-2h63-pw4q`, `CVE-2026-47695` · Maven `cc.tweaked:cc-tweaked-1.19.3-core` and 7 more: affected `<1.119.0`, fixed in `1.119.0` · CVSS 7.1 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Artemis has an Incorrect Authorization issue](https://agentprime.io/advisories/GHSA-rf99-f9j2-gv3f.md)
  `GHSA-rf99-f9j2-gv3f`, `CVE-2026-40914` · Maven `org.apache.artemis:artemis-stomp-protocol`: affected `>=2.50.0, <2.54.0 || >=2.0.0, <=2.44.0`, fixed in `2.54.0` · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Broken access control
- [QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability](https://agentprime.io/advisories/GHSA-p47f-322f-whfh.md)
  `GHSA-p47f-322f-whfh`, `CVE-2026-9828` · Maven `ch.qos.logback:logback-core`: affected `<1.5.33`, fixed in `1.5.33` · CVSS 2.9 Low · Not analysed yet · Published 28 May 2026 · Tags: Insecure deserialization
- [Apache Ignite REST API Has a Relative Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-v45h-mqf4-6939.md)
  `GHSA-v45h-mqf4-6939`, `CVE-2025-48977` · Maven `org.apache.ignite:ignite-core`: affected `>=2.0.0, <2.18.0`, fixed in `2.18.0` · CVSS 8.5 High · Not analysed yet · Published 28 May 2026 · Tags: Path traversal
- [Keycloak has Insufficient Session Expiration](https://agentprime.io/advisories/GHSA-v5g5-wwmp-jppw.md)
  `GHSA-v5g5-wwmp-jppw`, `CVE-2026-9802` · Maven `org.keycloak:keycloak-services`: affected `<=26.4.7 || >=26.5.0, <26.6.3`, fixed in `26.6.3` · CVSS 6.8 Medium · Not analysed yet · Published 28 May 2026 · Tags: Authentication bypass
- [Keycloak Vulnerable to Improper Validation of Specified Quantity in Input](https://agentprime.io/advisories/GHSA-f6r7-6w34-x2gp.md)
  `GHSA-f6r7-6w34-x2gp`, `CVE-2026-9801` · Maven `org.keycloak:keycloak-ldap-federation`: affected `<26.6.3`, fixed in `26.6.3` · CVSS 4.9 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-1284
- [Keycloak has an Out-of-bounds Read](https://agentprime.io/advisories/GHSA-cpf7-j4cf-vqx4.md)
  `GHSA-cpf7-j4cf-vqx4`, `CVE-2026-9803` · Maven `org.keycloak:keycloak-services`: affected `<=26.4.7 || >=26.5.0, <26.6.3`, fixed in `26.6.3` · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Memory corruption
- [Keycloak has an Authentication Bypass by Primary Weakness](https://agentprime.io/advisories/GHSA-q6h7-xxp7-7429.md)
  `GHSA-q6h7-xxp7-7429`, `CVE-2026-9798` · Maven `org.keycloak:keycloak-services`: affected `<=26.4.7 || >=26.5.0, <=26.6.4`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-305
- [Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition](https://agentprime.io/advisories/GHSA-pq65-77rc-7r8c.md)
  `GHSA-pq65-77rc-7r8c`, `CVE-2026-9796` · Maven `org.keycloak:keycloak-server`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Race condition
- [Keycloak has an Improper Verification of Cryptographic Signature issue](https://agentprime.io/advisories/GHSA-p3v8-fm5p-v84h.md)
  `GHSA-p3v8-fm5p-v84h`, `CVE-2026-9793` · Maven `org.keycloak:keycloak-services`: affected `<=26.6.4`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 28 May 2026 · Tags: Weak cryptography or TLS
- [Keycloak Generates an Error Message Containing Sensitive Information](https://agentprime.io/advisories/GHSA-fqjh-8322-vgrv.md)
  `GHSA-fqjh-8322-vgrv`, `CVE-2026-9794` · Maven `org.keycloak:keycloak-services`: affected `<=26.4.7 || >=26.5.0, <26.6.3`, fixed in `26.6.3` · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Information disclosure
- [Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement](https://agentprime.io/advisories/GHSA-8hcx-p7m8-gc28.md)
  `GHSA-8hcx-p7m8-gc28` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 7.3 High · Withdrawn · Not analysed yet · Published 28 May 2026 · Tags: Privilege escalation
- [Keycloak Vulnerable to Incorrect Authorization](https://agentprime.io/advisories/GHSA-4q93-v92x-p89f.md)
  `GHSA-4q93-v92x-p89f`, `CVE-2026-9791` · Maven `org.keycloak:keycloak-server-spi-private` and 1 more: affected `>=26.5.0, <26.6.3 || <=26.4.7`, fixed in `26.6.3` · CVSS 4.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Broken access control
- [Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege](https://agentprime.io/advisories/GHSA-33j3-g875-37rp.md)
  `GHSA-33j3-g875-37rp`, `CVE-2026-9792` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.6.3 || <=26.4.7`, fixed in `26.6.3` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-280
- [Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection](https://agentprime.io/advisories/GHSA-2g95-6x5q-xjwj.md)
  `GHSA-2g95-6x5q-xjwj`, `CVE-2026-46621` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection
- [Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override](https://agentprime.io/advisories/GHSA-vmwp-vh32-rj75.md)
  `GHSA-vmwp-vh32-rj75`, `CVE-2026-46562` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection
- [Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-hj3h-r49w-34wh.md)
  `GHSA-hj3h-r49w-34wh`, `CVE-2026-9674` · Maven `org.jenkins-ci.plugins:jenkins-multijob-plugin`: affected `<669.v9d96a`, fixed in `669.v9d96a` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins buildgraph-view Plugin does not escape the build URL](https://agentprime.io/advisories/GHSA-43ph-42gv-7965.md)
  `GHSA-43ph-42gv-7965`, `CVE-2026-48927` · Maven `org.jenkins-ci.plugins:buildgraph-view`: affected `<=1.8`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site scripting (XSS)
- [Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-rf8w-7c3g-7h3g.md)
  `GHSA-rf8w-7c3g-7h3g`, `CVE-2026-48925` · Maven `org.jenkins-ci.plugins:github-integration-parent`: affected `<0.7.4`, fixed in `0.7.4` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login](https://agentprime.io/advisories/GHSA-r8fj-rff6-f7h5.md)
  `GHSA-r8fj-rff6-f7h5`, `CVE-2026-48924` · Maven `org.jenkins-ci.plugins:bitbucket-oauth`: affected `<0.18`, fixed in `0.18` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Open redirect
- [Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint](https://agentprime.io/advisories/GHSA-p8jh-4p5p-2rfp.md)
  `GHSA-p8jh-4p5p-2rfp`, `CVE-2026-48926` · Maven `org.jenkins-ci.plugins:job-import-plugin`: affected `<143.145.v48f9a`, fixed in `143.145.v48f9a` · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA1LTI3VDE1OjMzOjI3LjAwMDAwMFoiLCJHSFNBLXA4amgtNHA1cC0ycmZwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA2LTA5VDA2OjMxOjU3LjAwMDAwMFoiLCJHSFNBLTRoZmgtNng4Zy1nd3BwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA2LTA5VDA2OjMxOjU3LjAwMDAwMFoiLCJHSFNBLTRoZmgtNng4Zy1nd3BwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.