# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter](https://agentprime.io/advisories/GHSA-7cmx-qjh8-7v3v.md)
  `GHSA-7cmx-qjh8-7v3v`, `CVE-2026-43867` · Maven `org.apache.camel:camel-pqc`: affected `>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled](https://agentprime.io/advisories/GHSA-6qw3-4796-5984.md)
  `GHSA-6qw3-4796-5984`, `CVE-2026-40859` · Maven `org.apache.camel:camel-netty-http` and 1 more: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.20.0`, fixed in `4.14.8`, `4.18.3`, `4.20.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization
- [LaunchServer FileServerHandler has an unauthenticated path traversal issue](https://agentprime.io/advisories/GHSA-5g75-477j-2c2f.md)
  `GHSA-5g75-477j-2c2f`, `CVE-2026-54617` · Maven `pro.gravit.launcher:launchserver-api`: affected `<=5.7.11`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Path traversal, Information disclosure, Hard-coded credentials
- [Keycloak: Unauthorized access via improper validation of encrypted SAML assertions](https://agentprime.io/advisories/GHSA-794g-x443-36f7.md)
  `GHSA-794g-x443-36f7`, `BIT-keycloak-2026-2092`, `CVE-2026-2092` · Maven `org.keycloak:keycloak-services`: affected `<=26.2.5 || >=26.3.0, <=26.4.7 || >=26.5.0, <26.5.5`, fixed in `26.5.5` · CVSS 7.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-1287
- [OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-p9jg-fcr6-3mhf.md)
  `GHSA-p9jg-fcr6-3mhf`, `CVE-2026-53712` · Maven `com.ongres.scram:scram-client` and 1 more: affected `<3.3`, fixed in `3.3` · CVSS 8.2 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-636, CWE-757
- [Keycloak has privilege escalation via improper scope mapping enforcement](https://agentprime.io/advisories/GHSA-32h4-44jj-c5vx.md)
  `GHSA-32h4-44jj-c5vx`, `CVE-2026-9795` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 7.3 High · Not analysed yet · Published 1 Jul 2026 · Tags: Privilege escalation
- [land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory](https://agentprime.io/advisories/GHSA-j6hm-v3x2-qv6j.md)
  `GHSA-j6hm-v3x2-qv6j` · Maven `land.oras:oras-java-sdk`: affected `<0.6.4`, fixed in `0.6.4` · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Path traversal
- [CrateDB's Blob HTTP handler bypasses authorization](https://agentprime.io/advisories/GHSA-2xv8-gjwh-fv8p.md)
  `GHSA-2xv8-gjwh-fv8p`, `CVE-2026-49989` · Maven `io.crate:crate`: affected `<6.2.8 || >=6.3.0, <6.3.2`, fixed in `6.2.8`, `6.3.2` · CVSS 7.1 High · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control
- [Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK](https://agentprime.io/advisories/GHSA-v3jc-474w-2wm6.md)
  `GHSA-v3jc-474w-2wm6`, `CVE-2026-54428` · Maven `org.apache.httpcomponents.core5:httpcore5-h2`: affected `<5.4.3 || >=5.5-alpha1, <5.5-beta2`, fixed in `5.4.3`, `5.5-beta2` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service
- [Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service](https://agentprime.io/advisories/GHSA-hf6x-8p5f-cgmf.md)
  `GHSA-hf6x-8p5f-cgmf`, `CVE-2026-54399` · Maven `org.apache.httpcomponents.core5:httpcore5`: affected `<5.4.3 || >=5.5-alpha1, <5.5-beta2`, fixed in `5.4.3`, `5.5-beta2` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service
- [GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field](https://agentprime.io/advisories/GHSA-582q-v28r-7cxr.md)
  `GHSA-582q-v28r-7cxr`, `CVE-2026-46487` · Maven `org.geonetwork-opensource:geonetwork`: affected `>=4.0.0-alpha.1, <=4.0.6-0 || >=4.2.0, <4.2.16 || >=4.4.0, <4.4.11`, fixed in `4.2.16`, `4.4.11` · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control
- [GeoNetwork has reflected XSS through client-side template injection](https://agentprime.io/advisories/GHSA-2v4m-fw6c-g78f.md)
  `GHSA-2v4m-fw6c-g78f`, `CVE-2026-39379` · Maven `org.geonetwork-opensource:geonetwork`: affected `>=3.0.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.15 || >=4.4.0, <4.4.10`, fixed in `4.2.15`, `4.4.10` · CVSS 7.1 High · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Sigstore Java has a vulnerability with bundle verification of integratedTime](https://agentprime.io/advisories/GHSA-qqw8-7c2r-jxch.md)
  `GHSA-qqw8-7c2r-jxch`, `CVE-2026-48791` · Maven `dev.sigstore:sigstore-java`: affected `>=2.0.0, <2.1.0`, fixed in `2.1.0` · CVSS 2.0 Low · Not analysed yet · Published 30 Jun 2026 · Tags: Weak cryptography or TLS
- [Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation](https://agentprime.io/advisories/GHSA-7ph3-grqh-pv9v.md)
  `GHSA-7ph3-grqh-pv9v`, `CVE-2025-53648` · Maven `org.apache.gravitino:catalog-jdbc-common`: affected `>=0.5.0, <1.0.0`, fixed in `1.0.0` · CVSS 5.4 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: SQL injection
- [Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-xjwq-9jw5-jf7w.md)
  `GHSA-xjwq-9jw5-jf7w`, `BIT-activemq-2026-49432`, `CVE-2026-49432` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-20, CWE-839
- [Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability](https://agentprime.io/advisories/GHSA-mhp6-f224-j2c3.md)
  `GHSA-mhp6-f224-j2c3`, `BIT-activemq-2026-54475`, `CVE-2026-54475` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-j548-68g5-9j7x.md)
  `GHSA-j548-68g5-9j7x`, `BIT-activemq-2026-52760`, `CVE-2026-52760` · Maven `org.apache.activemq:activemq-web-console` and 1 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 6.1 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-h5gm-rvw6-2xpx.md)
  `GHSA-h5gm-rvw6-2xpx`, `BIT-activemq-2026-49434`, `CVE-2026-49434` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-20
- [Apache ActiveMQ Improper Authorization vulnerability](https://agentprime.io/advisories/GHSA-f892-4h9f-j7g9.md)
  `GHSA-f892-4h9f-j7g9`, `BIT-activemq-2026-49877`, `CVE-2026-49877` · Maven `org.apache.activemq:apache-activemq`: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 8.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control
- [Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability](https://agentprime.io/advisories/GHSA-f77w-px59-cqf5.md)
  `GHSA-f77w-px59-cqf5`, `BIT-activemq-2026-53917`, `CVE-2026-53917` · Maven `org.apache.activemq:activemq-all` and 3 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Denial of service
- [Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability](https://agentprime.io/advisories/GHSA-9qj4-v6r6-3wmx.md)
  `GHSA-9qj4-v6r6-3wmx`, `BIT-activemq-2026-50750`, `CVE-2026-50750` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `>=5.19.7, <5.19.8 || >=6.2.6, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Denial of service
- [Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability](https://agentprime.io/advisories/GHSA-7259-vf48-52q3.md)
  `GHSA-7259-vf48-52q3`, `BIT-activemq-2026-50734`, `CVE-2026-50734` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.8 || >=6.0.0, <6.2.7`, fixed in `5.19.8`, `6.2.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Denial of service
- [Apache Tomcat has a Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-pg42-rg8c-j886.md)
  `GHSA-pg42-rg8c-j886`, `BIT-tomcat-2026-50229`, `CVE-2026-50229` · Maven `org.apache.tomcat:tomcat`: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 || <=7.0.109`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 6.1 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability](https://agentprime.io/advisories/GHSA-mqg3-r7h5-24x4.md)
  `GHSA-mqg3-r7h5-24x4`, `BIT-tomcat-2026-55276`, `CVE-2026-55276` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-670
- [Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability](https://agentprime.io/advisories/GHSA-h792-v28v-ppgr.md)
  `GHSA-h792-v28v-ppgr`, `BIT-tomcat-2026-53404`, `CVE-2026-53404` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 7.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-670
- [Apache Tomcat has an Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-c5ph-rghf-fjfj.md)
  `GHSA-c5ph-rghf-fjfj`, `BIT-tomcat-2026-55955`, `CVE-2026-55955` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.13, <9.0.119 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass
- [Apache Tomcat has a Missing Critical Step in Authentication vulnerability](https://agentprime.io/advisories/GHSA-7895-gffq-w6jq.md)
  `GHSA-7895-gffq-w6jq`, `CVE-2026-55957` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.5 || >=10.1.0-M1, <10.1.37 || >=9.0.0.M1, <9.0.101 || >=8.5.0, <=8.5.100 || <=7.0.109`, fixed in `11.0.5`, `10.1.37`, `9.0.101` · CVSS 7.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass
- [Apache Tomcat has an Improper Authorization vulnerability](https://agentprime.io/advisories/GHSA-5v3h-fjv2-54fg.md)
  `GHSA-5v3h-fjv2-54fg`, `BIT-tomcat-2026-55956`, `CVE-2026-55956` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 || <=7.0.109`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Broken access control
- [Apache Tomcat util accepted misconfigured CRLs](https://agentprime.io/advisories/GHSA-4x29-79gh-6v8q.md)
  `GHSA-4x29-79gh-6v8q`, `BIT-tomcat-2026-53434`, `CVE-2026-53434` · Maven `org.apache.tomcat:tomcat-util`: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M7, <10.1.56 || >=9.0.83, <9.0.119`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-390
- [OpenAM OAuth Authorization Bypass via PKCE Challenge](https://agentprime.io/advisories/GHSA-4v2w-2wqp-mc85.md)
  `GHSA-4v2w-2wqp-mc85`, `CVE-2026-48717` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Broken access control
- [OpenAM OAuth Client Impersonation via JWKS Resolver Cache](https://agentprime.io/advisories/GHSA-f2cx-463q-7m2c.md)
  `GHSA-f2cx-463q-7m2c`, `CVE-2026-47426` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.6 High · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass
- [OpenAM Authenticated RCE via Groovy Sandbox Escape](https://agentprime.io/advisories/GHSA-69j4-qvqr-hpw3.md)
  `GHSA-69j4-qvqr-hpw3`, `CVE-2026-47424` · Maven `org.openidentityplatform.openam:openam-scripting`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.5 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-693
- [OpenAM Account Takeover via Unverified Password Change in OAuth2 Module](https://agentprime.io/advisories/GHSA-gf57-4mp6-m85x.md)
  `GHSA-gf57-4mp6-m85x`, `CVE-2026-46623` · Maven `org.openidentityplatform.openam:openam-auth-oauth2`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.4 High · Not analysed yet · Published 26 Jun 2026 · Tags: Hard-coded credentials, CWE-620
- [OpenAM Authentication Bypass via MSISDN LDAP Injection](https://agentprime.io/advisories/GHSA-xq73-fvmr-jvmm.md)
  `GHSA-xq73-fvmr-jvmm`, `CVE-2026-46619` · Maven `org.openidentityplatform.openam:openam-auth-msisdn`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Other injection, CWE-1188
- [Apache IoTDB has a Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-xrvj-h9w2-3q69.md)
  `GHSA-xrvj-h9w2-3q69`, `CVE-2025-55017` · Maven `org.apache.iotdb:iotdb-server`: affected `>=2.0.0, <2.0.6 || >=1.0.0, <1.3.6`, fixed in `2.0.6`, `1.3.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal
- [JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution](https://agentprime.io/advisories/GHSA-r937-wjx7-w2jp.md)
  `GHSA-r937-wjx7-w2jp`, `CVE-2026-53914` · Maven `org.jetbrains.kotlin:kotlin-gradle-plugin`: affected `<2.4.20-Beta1`, fixed in `2.4.20-Beta1` · CVSS 6.7 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization
- [Apache IoTDB has a Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-h548-jhj8-q85h.md)
  `GHSA-h548-jhj8-q85h`, `CVE-2025-64152` · Maven `org.apache.iotdb:iotdb-server`: affected `>=1.0.0, <1.3.6 || >=2.0.0, <2.0.7`, fixed in `1.3.6`, `2.0.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal
- [Apache Kerby has a bypass the Kerberos pre-authentication check](https://agentprime.io/advisories/GHSA-262p-fj3f-xh7v.md)
  `GHSA-262p-fj3f-xh7v`, `CVE-2026-57915` · Maven `org.apache.kerby:kerb-server`: affected `<2.1.2`, fixed in `2.1.2` · CVSS 7.3 High · Not analysed yet · Published 26 Jun 2026 · Tags: Authentication bypass, CWE-358
- [Apache Kerby vulnerable to denial of service](https://agentprime.io/advisories/GHSA-x6vc-x4v4-hjhr.md)
  `GHSA-x6vc-x4v4-hjhr`, `CVE-2026-57914` · Maven `org.apache.kerby:kerby-asn1`: affected `<2.1.2`, fixed in `2.1.2` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service
- [Apicurio Registry is vulnerable to denial of service through XML entity expansion](https://agentprime.io/advisories/GHSA-748j-wm96-4wh5.md)
  `GHSA-748j-wm96-4wh5`, `CVE-2026-12993` · Maven `io.apicurio:apicurio-registry-schema-util-xml`: affected `>=3.3.0, <3.3.1 || <3.2.6`, fixed in `3.3.1`, `3.2.6` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service
- [Apicurio Registry allows upload of WSDL raising HTTP request](https://agentprime.io/advisories/GHSA-rcmh-vfq7-8gf4.md)
  `GHSA-rcmh-vfq7-8gf4`, `CVE-2026-12992` · Maven `io.apicurio:apicurio-registry-schema-util-wsdl`: affected `>=3.3.0, <3.3.1 || <3.2.6`, fixed in `3.3.1`, `3.2.6` · CVSS 7.4 High · Not analysed yet · Published 26 Jun 2026 · Tags: Server-side request forgery (SSRF)
- [Duplicate Advisory: Authentication bypass via jwt algorithm confusion](https://agentprime.io/advisories/GHSA-gqj5-2xp5-3qmp.md)
  `GHSA-gqj5-2xp5-3qmp` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 26 Jun 2026 · Tags: Weak cryptography or TLS
- [Apicurio Registry utilities allow SSRF and denial of service through XML parsing](https://agentprime.io/advisories/GHSA-7g64-f2hm-vjxp.md)
  `GHSA-7g64-f2hm-vjxp`, `CVE-2026-12975` · Maven `io.apicurio:apicurio-registry-schema-util-common`: affected `>=3.3.0, <3.3.1 || <3.2.6`, fixed in `3.3.1`, `3.2.6` · CVSS 8.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: XML external entities (XXE)
- [nextflow auth login command has incorrect default permissions](https://agentprime.io/advisories/GHSA-92qf-fcph-v5wr.md)
  `GHSA-92qf-fcph-v5wr`, `CVE-2026-48722` · Maven `io.nextflow:nextflow`: affected `>=25.09.2-edge, <25.10.6 || >=26.00.0-edge, <26.04.3`, fixed in `25.10.6`, `26.04.3` · CVSS 5.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Broken access control
- [Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token](https://agentprime.io/advisories/GHSA-q929-g23j-2rc7.md)
  `GHSA-q929-g23j-2rc7` · Maven `org.keycloak:keycloak-services`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass
- [Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass](https://agentprime.io/advisories/GHSA-gfv4-4vr2-rr4g.md)
  `GHSA-gfv4-4vr2-rr4g` · Maven `org.keycloak:keycloak-services`: affected `*`, no fixed version yet · CVSS 4.6 Medium · Withdrawn · Not analysed yet · Published 25 Jun 2026 · Tags: Broken access control
- [Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing](https://agentprime.io/advisories/GHSA-7pm9-g8jh-3m74.md)
  `GHSA-7pm9-g8jh-3m74` · Maven `org.keycloak:keycloak-services`: affected `*`, no fixed version yet · CVSS 4.9 Medium · Withdrawn · Not analysed yet · Published 25 Jun 2026 · Tags: Path traversal
- [Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison](https://agentprime.io/advisories/GHSA-79qw-g39g-mfxc.md)
  `GHSA-79qw-g39g-mfxc` · Maven `org.keycloak:keycloak-policy-enforcer` and 1 more: affected `*`, no fixed version yet · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-1025
- [Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass](https://agentprime.io/advisories/GHSA-37j9-56gh-j2r7.md)
  `GHSA-37j9-56gh-j2r7` · Maven `org.keycloak:keycloak-services`: affected `*`, no fixed version yet · CVSS 7.3 High · Withdrawn · Not analysed yet · Published 25 Jun 2026 · Tags: Cross-site scripting (XSS)
- [OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing](https://agentprime.io/advisories/GHSA-386j-6m86-78f9.md)
  `GHSA-386j-6m86-78f9`, `CVE-2026-46560` · Maven `org.openidentityplatform.openam:openam-radius`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Weak cryptography or TLS
- [OpenAM Arbitrary OAuth Token Minting via Push Registration](https://agentprime.io/advisories/GHSA-cj8f-2fhf-826r.md)
  `GHSA-cj8f-2fhf-826r`, `CVE-2026-46498` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.6 High · Not analysed yet · Published 25 Jun 2026 · Tags: Broken access control
- [OpenAM has Unsafe Java Deserialization via SNS](https://agentprime.io/advisories/GHSA-pp89-732f-3g8q.md)
  `GHSA-pp89-732f-3g8q`, `CVE-2026-45794` · Maven `org.openidentityplatform.openam:openam-push-notification`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.7 High · Not analysed yet · Published 25 Jun 2026 · Tags: Insecure deserialization
- [Apache Shiro shiro-guice module vulnerable to authentication bypass](https://agentprime.io/advisories/GHSA-qj64-jj84-w38j.md)
  `GHSA-qj64-jj84-w38j`, `CVE-2026-56091` · Maven `org.apache.shiro:shiro-guice`: affected `>=2.0.0, <3.0.0`, fixed in `3.0.0` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-289
- [Apache Shiro's "remember me" cookie age is not verified on the server.](https://agentprime.io/advisories/GHSA-m8g6-vrr2-x7ff.md)
  `GHSA-m8g6-vrr2-x7ff`, `CVE-2026-56130` · Maven `org.apache.shiro:shiro-core` and 1 more: affected `>=1.2.4, <3.0.0`, fixed in `3.0.0` · CVSS 2.0 Low · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass
- [OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints](https://agentprime.io/advisories/GHSA-p462-xxwx-pqf4.md)
  `GHSA-p462-xxwx-pqf4`, `CVE-2026-45052` · Maven `org.openidentityplatform.openam:openam-federation-library`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage](https://agentprime.io/advisories/GHSA-6c99-87fr-6q7r.md)
  `GHSA-6c99-87fr-6q7r`, `CVE-2026-45051` · Maven `org.openidentityplatform.openam:openam-auth-webauthn`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Insecure deserialization
- [Jenkins Zowe zDevOps Plugin has a missing permission check](https://agentprime.io/advisories/GHSA-xx59-jv36-5r44.md)
  `GHSA-xx59-jv36-5r44`, `CVE-2026-57307` · Maven `io.jenkins.plugins:zdevops`: affected `<=1.1.3.50.ve350c9b`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Payara Server Full has a Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-x939-7fq5-v9v6.md)
  `GHSA-x939-7fq5-v9v6`, `CVE-2026-12986` · Maven `fish.payara.distributions:payara`: affected `>=4.0.0, <7.2026.6`, fixed in `7.2026.6` · CVSS 7.3 High · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF)
- [Jenkins MCP Server Plugin missing a permission check](https://agentprime.io/advisories/GHSA-mpff-xhg4-vr45.md)
  `GHSA-mpff-xhg4-vr45`, `CVE-2026-57300` · Maven `io.jenkins.plugins:mcp-server`: affected `<0.178.vffe5a`, fixed in `0.178.vffe5a` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [Jenkins FitNesse Plugin stores passwords unencrypted](https://agentprime.io/advisories/GHSA-j4ph-wp3c-c37w.md)
  `GHSA-j4ph-wp3c-c37w`, `CVE-2026-57302` · Maven `org.jenkins-ci.plugins:fitnesse`: affected `<=1.36`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-256

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA2LTI0VDE1OjMxOjQ4LjAwMDAwMFoiLCJHSFNBLWo0cGgtd3AzYy1jMzd3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA3LTA2VDA5OjMwOjI4LjAwMDAwMFoiLCJHSFNBLTd2NTUtcTl4My04M2NqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA3LTA2VDA5OjMwOjI4LjAwMDAwMFoiLCJHSFNBLTd2NTUtcTl4My04M2NqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.