# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [Jenkins Contrast Continuous Application Security Plugin missing permission checks](https://agentprime.io/advisories/GHSA-8263-qv4g-vfxr.md) `GHSA-8263-qv4g-vfxr`, `CVE-2026-57299` · Maven `org.jenkins-ci.plugins:contrast-continuous-application-security`: affected `<3.12`, fixed in `3.12` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-6qc4-57v3-28rr.md) `GHSA-6qc4-57v3-28rr`, `CVE-2026-57298` · Maven `org.jenkins-ci.plugins:contrast-continuous-application-security`: affected `<3.12`, fixed in `3.12` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE](https://agentprime.io/advisories/GHSA-5qh3-hxx9-w26p.md) `GHSA-5qh3-hxx9-w26p`, `CVE-2026-57301` · Maven `org.jenkins-ci.plugins:zapper`: affected `<=1.0.7`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-610 - [Jenkins Zowe zDevOps Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-43m2-hcmm-qpm7.md) `GHSA-43m2-hcmm-qpm7`, `CVE-2026-57306` · Maven `io.jenkins.plugins:zdevops`: affected `<=1.1.3.50.ve350c9b`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-429r-3j78-2pxm.md) `GHSA-429r-3j78-2pxm`, `CVE-2026-57305` · Maven `org.jenkins-ci.plugins:assembla`: affected `<=1.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins Assembla Plugin has a missing permission check](https://agentprime.io/advisories/GHSA-2r5w-jh6g-8hff.md) `GHSA-2r5w-jh6g-8hff`, `CVE-2026-57304` · Maven `org.jenkins-ci.plugins:assembla`: affected `<=1.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Assembla Plugin has an XXE vulnerability](https://agentprime.io/advisories/GHSA-2q27-6p2h-q6r3.md) `GHSA-2q27-6p2h-q6r3`, `CVE-2026-57303` · Maven `org.jenkins-ci.plugins:assembla`: affected `<=1.4`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Jenkins Git client Plugin has an OS command injection vulnerability on agents](https://agentprime.io/advisories/GHSA-wp5x-hrrw-6r4g.md) `GHSA-wp5x-hrrw-6r4g`, `CVE-2026-57282` · Maven `org.jenkins-ci.plugins:git-client`: affected `<6.6.1`, fixed in `6.6.1` · CVSS 5.0 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Command injection - [Jenkins Gitee Plugin missing permission checks](https://agentprime.io/advisories/GHSA-wjmq-rpqq-w4h9.md) `GHSA-wjmq-rpqq-w4h9`, `CVE-2026-57291` · Maven `org.jenkins-ci.plugins:gitee`: affected `<1292.v2559f2f3f2c0`, fixed in `1292.v2559f2f3f2c0` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Gitee Plugin has a cross-site request forgery vulnerability](https://agentprime.io/advisories/GHSA-w794-rwp2-jc9m.md) `GHSA-w794-rwp2-jc9m`, `CVE-2026-57292` · Maven `org.jenkins-ci.plugins:gitee`: affected `<1292.v2559f2f3f2c0`, fixed in `1292.v2559f2f3f2c0` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins Contrast Continuous Application Security Plugin has a missing permission check](https://agentprime.io/advisories/GHSA-p44q-fmwr-jqr7.md) `GHSA-p44q-fmwr-jqr7`, `CVE-2026-57297` · Maven `org.jenkins-ci.plugins:contrast-continuous-application-security`: affected `<3.12`, fixed in `3.12` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation](https://agentprime.io/advisories/GHSA-jwhr-h7pc-3974.md) `GHSA-jwhr-h7pc-3974`, `CVE-2026-57289` · Maven `io.jenkins.plugins:bitbucket-push-and-pull-request`: affected `<3.3.9`, fixed in `3.3.9` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Weak cryptography or TLS - [Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs](https://agentprime.io/advisories/GHSA-jhcq-6wqp-qcfx.md) `GHSA-jhcq-6wqp-qcfx`, `CVE-2026-57293` · Maven `org.jenkins-ci.plugins:gitee`: affected `<1292.v2559f2f3f2c0`, fixed in `1292.v2559f2f3f2c0` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names](https://agentprime.io/advisories/GHSA-hwvp-7xqv-8jx3.md) `GHSA-hwvp-7xqv-8jx3`, `CVE-2026-57286` · Maven `org.jenkins-ci.tools:git-parameter`: affected `<462.463`, fixed in `462.463` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins External Workspace Manager Plugin has a path traversal vulnerability](https://agentprime.io/advisories/GHSA-hrmj-8fm9-cg8x.md) `GHSA-hrmj-8fm9-cg8x`, `CVE-2026-57296` · Maven `org.jenkins-ci.plugins:external-workspace-manager`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: Path traversal - [Jenkins Active Directory Plugin has an LDAP injection vulnerability](https://agentprime.io/advisories/GHSA-gx55-p8g7-p3fh.md) `GHSA-gx55-p8g7-p3fh`, `CVE-2026-57288` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.2`, fixed in `2.41.2` · CVSS 3.7 Low · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection - [Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs](https://agentprime.io/advisories/GHSA-g7c6-wxjf-8564.md) `GHSA-g7c6-wxjf-8564`, `CVE-2026-57285` · Maven `org.jenkins-ci.plugins:github-branch-source`: affected `<1967.1970`, fixed in `1967.1970` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Priority Sorter Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-fq56-wvv2-p8jf.md) `GHSA-fq56-wvv2-p8jf`, `CVE-2026-57290` · Maven `org.jenkins-ci.plugins:PrioritySorter`: affected `<936.937.v5581d0b`, fixed in `936.937.v5581d0b` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins Script Security Plugin has a script security bypass vulnerability](https://agentprime.io/advisories/GHSA-cfj9-2vgr-hpxp.md) `GHSA-cfj9-2vgr-hpxp`, `CVE-2026-57281` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection, Code injection, CWE-693 - [Jenkins Script Security Plugin sandbox bypass vulnerability](https://agentprime.io/advisories/GHSA-c3jm-9vj7-5v66.md) `GHSA-c3jm-9vj7-5v66`, `CVE-2026-57280` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-693 - [Jenkins EC2 Fleet Plugin has a missing permission check](https://agentprime.io/advisories/GHSA-9v77-j4xv-34gq.md) `GHSA-9v77-j4xv-34gq`, `CVE-2026-57294` · Maven `com.amazon.jenkins.fleet:ec2-fleet`: affected `<4.2.3.540.va`, fixed in `4.2.3.540.va` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control - [Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations](https://agentprime.io/advisories/GHSA-8qr4-27mh-hqfr.md) `GHSA-8qr4-27mh-hqfr`, `CVE-2026-57287` · Maven `org.jenkins-ci.plugins:jobConfigHistory`: affected `<1367`, fixed in `1367` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Information disclosure - [Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-72c8-3wwg-r59w.md) `GHSA-72c8-3wwg-r59w`, `CVE-2026-57283` · Maven `io.jenkins.plugins:pipeline-groovy-lib`: affected `<4331.4333`, fixed in `4331.4333` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-2x9c-vp3g-hvv2.md) `GHSA-2x9c-vp3g-hvv2`, `CVE-2026-57295` · Maven `com.amazon.jenkins.fleet:ec2-fleet`: affected `<4.2.3.540.va`, fixed in `4.2.3.540.va` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types](https://agentprime.io/advisories/GHSA-2w2h-gwwj-fh3q.md) `GHSA-2w2h-gwwj-fh3q`, `CVE-2026-57284` · Maven `io.jenkins.plugins:pipeline-groovy-lib`: affected `<4331.4333`, fixed in `4331.4333` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Code injection - [OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation](https://agentprime.io/advisories/GHSA-r6fj-869h-4f6q.md) `GHSA-r6fj-869h-4f6q`, `CVE-2026-48480` · Maven `io.netty.incubator:netty-incubator-codec-ohttp`: affected `<0.0.22.Final`, fixed in `0.0.22.Final` · CVSS 6.6 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-325 - [Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)](https://agentprime.io/advisories/GHSA-vjr9-f93j-mjr7.md) `GHSA-vjr9-f93j-mjr7` · Maven `io.openremote:openremote-manager`: affected `*`, no fixed version yet · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist](https://agentprime.io/advisories/GHSA-85qj-f5wg-rwp9.md) `GHSA-85qj-f5wg-rwp9`, `CVE-2026-41862` · Maven `org.springframework.statemachine:spring-statemachine-kryo`: affected `>=3.2.0, <=3.2.4 || >=4.0.0, <4.0.2`, fixed in `4.0.2` · CVSS 8.8 High · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization - [jackson-databind has @JsonView bypass for setterless creator properties](https://agentprime.io/advisories/GHSA-5hh8-q8hv-fr38.md) `GHSA-5hh8-q8hv-fr38`, `CVE-2026-54517` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.21.0, <2.21.4 || >=3.0.0, <3.1.4`, fixed in `2.21.4`, `3.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields](https://agentprime.io/advisories/GHSA-9fxm-vc8v-hj55.md) `GHSA-9fxm-vc8v-hj55`, `CVE-2026-54516` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.21.0, <2.21.4 || >=3.0.0, <3.1.4`, fixed in `2.21.4`, `3.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties](https://agentprime.io/advisories/GHSA-5jmj-h7xm-6q6v.md) `GHSA-5jmj-h7xm-6q6v`, `CVE-2026-54515` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=3.1.0, <3.1.4 || >=2.8.0, <2.18.9 || >=2.19.0, <2.21.5 || >=2.22.0, <2.22.1`, fixed in `3.1.4`, `2.18.9`, `2.21.5`, `2.22.1` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)](https://agentprime.io/advisories/GHSA-hgj6-7826-r7m5.md) `GHSA-hgj6-7826-r7m5`, `CVE-2026-54514` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.0.0, <2.18.8 || >=2.19.0, <2.21.4 || >=3.0.0, <3.1.4`, fixed in `2.18.8`, `2.21.4`, `3.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Server-side request forgery (SSRF) - [jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)](https://agentprime.io/advisories/GHSA-rmj7-2vxq-3g9f.md) `GHSA-rmj7-2vxq-3g9f`, `CVE-2026-54513` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.10.0, <2.18.8 || >=2.19.0, <2.21.4 || >=3.0.0, <3.1.4`, fixed in `2.18.8`, `2.21.4`, `3.1.4` · CVSS 8.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-184 - [jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation](https://agentprime.io/advisories/GHSA-j3rv-43j4-c7qm.md) `GHSA-j3rv-43j4-c7qm`, `CVE-2026-54512` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.10.0, <2.18.8 || >=3.0.0, <3.1.4 || >=2.19.0, <2.21.4`, fixed in `2.18.8`, `3.1.4`, `2.21.4` · CVSS 8.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Insecure deserialization, CWE-184 - [jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()](https://agentprime.io/advisories/GHSA-3wrr-7qpf-2prh.md) `GHSA-3wrr-7qpf-2prh`, `CVE-2026-50193` · Maven `com.fasterxml.jackson.core:jackson-databind`: affected `>=2.10.0, <2.14.0`, fixed in `2.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Denial of service - [jackson-databind has a @JsonView bypass for unwrapped creator parameters](https://agentprime.io/advisories/GHSA-rcqc-6cw3-h962.md) `GHSA-rcqc-6cw3-h962`, `CVE-2026-54518` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.21.0, <2.21.4`, fixed in `2.21.4` · CVSS 6.5 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet](https://agentprime.io/advisories/GHSA-r9pv-5rpp-vm8g.md) `GHSA-r9pv-5rpp-vm8g`, `CVE-2026-45049` · Maven `org.openidentityplatform.openam:openam-federation`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 8.3 High · Not analysed yet · Published 23 Jun 2026 · Tags: Information disclosure - [OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC](https://agentprime.io/advisories/GHSA-vvhj-w2jq-263q.md) `GHSA-vvhj-w2jq-263q`, `CVE-2026-45048` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 8.5 High · Not analysed yet · Published 23 Jun 2026 · Tags: Information disclosure, Broken access control - [expr-eval vulnerable to Code Execution](https://agentprime.io/advisories/GHSA-q9v2-7m5w-4693.md) `GHSA-q9v2-7m5w-4693`, `CVE-2026-12866` · Maven `org.webjars.npm:expr-eval` and 1 more: affected `<=2.0.2`, no fixed version yet · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection - [OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI](https://agentprime.io/advisories/GHSA-43x2-g84q-fmqx.md) `GHSA-43x2-g84q-fmqx`, `CVE-2026-46495` · Maven `org.openidentityplatform.opendj:opendj-server-legacy`: affected `<5.1.1`, fixed in `5.1.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Insecure deserialization - [Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types](https://agentprime.io/advisories/GHSA-c8q4-9h32-2ww8.md) `GHSA-c8q4-9h32-2ww8`, `CVE-2026-44795` · Maven `io.spinnaker.orca:orca-core` and 1 more: affected `<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3`, fixed in `2025.3.3`, `2025.4.4`, `2026.0.3` · CVSS 8.8 High · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection, Insecure deserialization - [OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via \`FSUtils.postToTarget\`](https://agentprime.io/advisories/GHSA-fhrq-3gmx-p879.md) `GHSA-fhrq-3gmx-p879`, `CVE-2026-44793` · Maven `org.openidentityplatform.openam:openam-federation-library`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.0 High · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS) - [OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)](https://agentprime.io/advisories/GHSA-fq9h-c788-fx73.md) `GHSA-fq9h-c788-fx73`, `CVE-2026-44203` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `>=13.0.0, <16.1.1`, fixed in `16.1.1` · CVSS 8.3 High · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS) - [OpenAM Authenticated Server-Side Request Forgery (SSRF) via \`/sessionservice\`](https://agentprime.io/advisories/GHSA-c556-q2mh-477v.md) `GHSA-c556-q2mh-477v`, `CVE-2026-44202` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Server-side request forgery (SSRF) - [xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro](https://agentprime.io/advisories/GHSA-w56x-9778-rppx.md) `GHSA-w56x-9778-rppx`, `CVE-2026-44179` · Maven `com.xwiki.pro:xwiki-pro-macros`: affected `>=1.13, <1.14.5`, fixed in `1.14.5` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Code injection - [OpenAM has LDAP Injection via \`\_queryId\` Parameter](https://agentprime.io/advisories/GHSA-2vg8-q4c2-5cw3.md) `GHSA-2vg8-q4c2-5cw3`, `CVE-2026-41573` · Maven `org.openidentityplatform.openam:openam-core-rest`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.1 High · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection - [Apache Atlas UI: Authenticated User XSS](https://agentprime.io/advisories/GHSA-v73p-f52r-fmmr.md) `GHSA-v73p-f52r-fmmr`, `CVE-2025-62198` · Maven `org.apache.atlas:atlas-dashboardv2`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 5.4 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS) - [Apache NiFi: Missing authorization when replacing Process Groups with restricted components](https://agentprime.io/advisories/GHSA-r2g5-993q-664g.md) `GHSA-r2g5-993q-664g`, `BIT-nifi-2026-44914`, `CVE-2026-44914` · Maven `org.apache.nifi:nifi-web-api`: affected `>=1.12.0, <2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control - [Apache NiFi allows read-only users to submit component configuration verification request](https://agentprime.io/advisories/GHSA-qvj8-gwpm-4x49.md) `GHSA-qvj8-gwpm-4x49`, `BIT-nifi-2026-44911`, `CVE-2026-44911` · Maven `org.apache.nifi:nifi-web-api`: affected `>=1.15.0, <2.10.0`, fixed in `2.10.0` · CVSS 2.3 Low · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control - [Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL](https://agentprime.io/advisories/GHSA-chxj-gxww-q98w.md) `GHSA-chxj-gxww-q98w`, `BIT-nifi-2026-44913`, `CVE-2026-44913` · Maven `org.apache.nifi:nifi-cdc-mysql-processors`: affected `>=1.2.0, <2.10.0`, fixed in `2.10.0` · CVSS 5.2 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-116 - [Apache NiFi fails to validate proxy host headers when constructing qualified URLs](https://agentprime.io/advisories/GHSA-8vm2-c32j-mvfr.md) `GHSA-8vm2-c32j-mvfr`, `CVE-2026-54665` · Maven `org.apache.nifi:nifi-jetty`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-346 - [OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)](https://agentprime.io/advisories/GHSA-h3m5-97jq-qjrf.md) `GHSA-h3m5-97jq-qjrf`, `CVE-2026-56120`, `CVE-2026-56784` · Maven `io.openremote:openremote-manager`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 8.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: Broken access control - [http4k: \`ServerFilters.DigestAuth\` / \`DigestAuthProvider\` defaulted to an always-true nonce verifier, disabling replay protection in default deployments](https://agentprime.io/advisories/GHSA-c7jm-38gq-h67h.md) `GHSA-c7jm-38gq-h67h`, `CVE-2026-100834` · Maven `org.http4k:http4k-security-digest`: affected `>=6.0.0.0, <6.48.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0`, fixed in `6.48.0.0`, `5.42.0.0`, `4.51.0.0` · CVSS 8.2 High · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass - [http4k: BasicCookieStorage\` (renamed \`InsecureCookieStorage\`) did not enforce RFC 6265 cookie scoping; new \`DefaultCookieStorage\` is now the default](https://agentprime.io/advisories/GHSA-pr33-38xx-6r26.md) `GHSA-pr33-38xx-6r26`, `CVE-2026-100725` · Maven `org.http4k:http4k-core`: affected `>=6.0.0.0, <6.48.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0`, fixed in `6.48.0.0`, `5.42.0.0`, `4.51.0.0` · CVSS 8.3 High · Not analysed yet · Published 19 Jun 2026 · Tags: Information disclosure - [http4k: \`HmacSha256.hash\` (despite the \`Hmac\` naming) computed a plain unkeyed digest; clarified by deprecation in favour of \`Sha256.hash\` / \`Sha256.hmac\`](https://agentprime.io/advisories/GHSA-m4w9-hjfw-vwj4.md) `GHSA-m4w9-hjfw-vwj4` · Maven `org.http4k:http4k-core`: affected `<6.49.0.0`, fixed in `6.49.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345 - [http4k: \`reverseProxy()\` defaulted to substring (\`Contains\`) matching on \`Host\`; tightened to \`Exact\`](https://agentprime.io/advisories/GHSA-jrpc-7vxp-69p6.md) `GHSA-jrpc-7vxp-69p6`, `CVE-2026-100724` · Maven `org.http4k:http4k-core`: affected `>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0`, fixed in `6.49.0.0`, `5.42.0.0`, `4.51.0.0` · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: HTTP request smuggling - [Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering](https://agentprime.io/advisories/GHSA-gx93-m64w-5m6h.md) `GHSA-gx93-m64w-5m6h`, `CVE-2026-55847` · Maven `io.qameta.allure:allure-generator`: affected `<2.39.0`, fixed in `2.39.0` · CVSS 6.1 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site scripting (XSS) - [Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read](https://agentprime.io/advisories/GHSA-82cg-3hv7-74gc.md) `GHSA-82cg-3hv7-74gc`, `CVE-2026-55846` · Maven `io.qameta.allure:allure-commandline`: affected `<2.39.0`, fixed in `2.39.0` · CVSS 6.2 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal - [CedarJava has policy injection vulnerability](https://agentprime.io/advisories/GHSA-qmch-v2q9-wg4p.md) `GHSA-qmch-v2q9-wg4p`, `CVE-2026-55773` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: Code injection - [CedarJava has type confusion vulnerability](https://agentprime.io/advisories/GHSA-93g4-m6xv-cmvr.md) `GHSA-93g4-m6xv-cmvr`, `CVE-2026-55772` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .