# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Keycloak services allows the issuance of access and refresh tokens for disabled users](https://agentprime.io/advisories/GHSA-wv3h-x6c4-r867.md)
  `GHSA-wv3h-x6c4-r867`, `CVE-2025-14559` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.2 || <26.4.9`, fixed in `26.5.2`, `26.4.9` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control, CWE-840
- [Keycloak does not validate and update refresh token usage atomically](https://agentprime.io/advisories/GHSA-m2w5-7xhv-w6fh.md)
  `GHSA-m2w5-7xhv-w6fh`, `CVE-2026-1035` · Maven `org.keycloak:keycloak-services`: affected `<=26.2.5`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 21 Jan 2026 · Tags: Race condition
- [XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability](https://agentprime.io/advisories/GHSA-r8w2-w357-9pjv.md)
  `GHSA-r8w2-w357-9pjv`, `CVE-2025-64087` · Maven `fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [XDocReport affected by an XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-7jc7-g598-2p64.md)
  `GHSA-7jc7-g598-2p64`, `CVE-2025-65482` · Maven `fr.opensagres.xdocreport:fr.opensagres.xdocreport.document`: affected `>=0.9.2, <2.0.4`, fixed in `2.0.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: XML external entities (XXE)
- [Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-7vw6-5q2f-7w5r.md)
  `GHSA-7vw6-5q2f-7w5r`, `CVE-2026-1180` · Maven `org.keycloak:keycloak-adapter-core`: affected `<=25.0.3`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Linkis: Password Exposure](https://agentprime.io/advisories/GHSA-6vfr-p2hx-6v32.md)
  `GHSA-6vfr-p2hx-6v32`, `CVE-2025-59355` · Maven `org.apache.linkis:linkis-metadata`: affected `>=1.0.0, <1.8.0`, fixed in `1.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Information disclosure
- [Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass](https://agentprime.io/advisories/GHSA-c399-q49h-qwc8.md)
  `GHSA-c399-q49h-qwc8`, `CVE-2025-29847` · Maven `org.apache.linkis:linkis`: affected `>=1.3.0, <1.8.0`, fixed in `1.8.0` · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2026 · Tags: Path traversal, CWE-20, CWE-177
- [risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability](https://agentprime.io/advisories/GHSA-vhcx-7rpg-hp39.md)
  `GHSA-vhcx-7rpg-hp39`, `CVE-2026-1050` · Maven `net.risesoft:risenet-y9boot-support-platform-service`: affected `<=9.7.0-M5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 17 Jan 2026 · Tags: Other injection, SQL injection
- [Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/GHSA-fccg-7w3p-w66f.md)
  `GHSA-fccg-7w3p-w66f`, `CVE-2025-15104` · Maven `nu.validator:validator` and 1 more: affected `<=26.1.11`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams](https://agentprime.io/advisories/GHSA-hrvf-g648-rf3m.md)
  `GHSA-hrvf-g648-rf3m`, `CVE-2026-0858` · Maven `net.sourceforge.plantuml:plantuml`: affected `<1.2026.0`, fixed in `1.2026.0` · CVSS 5.1 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Vert.x Web static handler component cache can be manipulated to deny the access to static files](https://agentprime.io/advisories/GHSA-cphf-4846-3xx9.md)
  `GHSA-cphf-4846-3xx9`, `CVE-2026-1002` · Maven `io.vertx:vertx-core`: affected `<4.5.24 || >=5.0.0.CR1, <5.0.7`, fixed in `4.5.24`, `5.0.7` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: HTTP request smuggling
- [Keycloak has an improper input validation vulnerability](https://agentprime.io/advisories/GHSA-v897-pv23-r8cw.md)
  `GHSA-v897-pv23-r8cw`, `CVE-2026-0976` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<=26.2.5`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 15 Jan 2026 · Tags: CWE-20
- [Apache Camel camel-neo4j component is vulnerable to cypher injection](https://agentprime.io/advisories/GHSA-4jrw-64vr-7g8m.md)
  `GHSA-4jrw-64vr-7g8m`, `CVE-2025-66169` · Maven `org.apache.camel:camel-neo4j`: affected `>=4.10.0, <4.10.8 || >=4.14.0, <4.14.3 || >=4.15.0, <4.17.0`, fixed in `4.10.8`, `4.14.3`, `4.17.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 Jan 2026 · Tags: Other injection, SQL injection
- [Jervis's AES CBC Mode is Without Authentication](https://agentprime.io/advisories/GHSA-gxp5-mv27-vjcj.md)
  `GHSA-gxp5-mv27-vjcj`, `CVE-2025-68931` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Jervis Has a JWT Algorithm Confusion Vulnerability](https://agentprime.io/advisories/GHSA-5pq9-5mpr-jj85.md)
  `GHSA-5pq9-5mpr-jj85`, `CVE-2025-68925` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 6.9 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS
- [Jervis Has Weak Random for Timing Attack Mitigation](https://agentprime.io/advisories/GHSA-c9q6-g3hr-8gww.md)
  `GHSA-c9q6-g3hr-8gww`, `CVE-2025-68704` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS
- [Jervis's Salt for PBKDF2 derived from password](https://agentprime.io/advisories/GHSA-36h5-vrq6-pp34.md)
  `GHSA-36h5-vrq6-pp34`, `CVE-2025-68703` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS
- [Jervis Has a SHA-256 Hex String Padding Bug](https://agentprime.io/advisories/GHSA-67rj-pjg6-pq59.md)
  `GHSA-67rj-pjg6-pq59`, `CVE-2025-68702` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS
- [Jervis has Deterministic AES IV Derivation from Passphrase](https://agentprime.io/advisories/GHSA-crxp-chh4-9ghp.md)
  `GHSA-crxp-chh4-9ghp`, `CVE-2025-68701` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS, CWE-340
- [Jervis Has a RSA PKCS#1 Padding Vulnerability](https://agentprime.io/advisories/GHSA-mqw7-c5gg-xq97.md)
  `GHSA-mqw7-c5gg-xq97`, `CVE-2025-68698` · Maven `net.gleske:jervis`: affected `<2.2`, fixed in `2.2` · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: Weak cryptography or TLS
- [Apache Struts 2 is Missing XML Validation](https://agentprime.io/advisories/GHSA-qcfc-hmrc-59x7.md)
  `GHSA-qcfc-hmrc-59x7`, `CVE-2025-68493` · Maven `com.opensymphony:xwork` and 2 more: affected `>=2.0.0`, no fixed version yet · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 11 Jan 2026 · Tags: XML external entities (XXE), CWE-112
- [XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService](https://agentprime.io/advisories/GHSA-2g22-wg49-fgv5.md)
  `GHSA-2g22-wg49-fgv5`, `CVE-2025-65091` · Maven `org.xwiki.contrib:macro-fullcalendar-pom`: affected `<2.4.5`, fixed in `2.4.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: SQL injection
- [XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService](https://agentprime.io/advisories/GHSA-637h-ch24-xp9m.md)
  `GHSA-637h-ch24-xp9m`, `CVE-2025-65090` · Maven `org.xwiki.contrib:macro-fullcalendar-pom`: affected `<2.4.6`, fixed in `2.4.6` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Information disclosure
- [FASTJSON Includes Functionality from Untrusted Control Sphere](https://agentprime.io/advisories/GHSA-jm7w-5684-pvh8.md)
  `GHSA-jm7w-5684-pvh8`, `CVE-2025-70974` · Maven `com.alibaba:fastjson`: affected `<1.2.48`, fixed in `1.2.48` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-829
- [Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization](https://agentprime.io/advisories/GHSA-gv94-wp4h-vv8p.md)
  `GHSA-gv94-wp4h-vv8p`, `CVE-2026-0707` · Maven `org.keycloak:keycloak-parent`: affected `<=26.5.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-551
- [Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing](https://agentprime.io/advisories/GHSA-qjm3-cvp9-3jj3.md)
  `GHSA-qjm3-cvp9-3jj3`, `CVE-2026-22187` · Maven `ome:pom-bio-formats`: affected `<=8.3.0`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Insecure deserialization
- [Bio-Formats has an XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-fcqj-76g3-q7qm.md)
  `GHSA-fcqj-76g3-q7qm`, `CVE-2026-22186`, `GHSA-x9vc-qh97-8gjp` · Maven `ome:pom-bio-formats`: affected `<=8.3.0`, no fixed version yet · CVSS 4.6 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: XML external entities (XXE)
- [OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE](https://agentprime.io/advisories/GHSA-5f29-2333-h9c7.md)
  `GHSA-5f29-2333-h9c7`, `CVE-2026-22244` · Maven `org.open-metadata:platform`: affected `>=1.5.0, <1.11.4`, fixed in `1.11.4` · CVSS 8.5 High · Not analysed yet · Published 7 Jan 2026 · Tags: Code injection
- [Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests](https://agentprime.io/advisories/GHSA-j382-5jj3-vw4j.md)
  `GHSA-j382-5jj3-vw4j`, `CVE-2025-12543` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.21.Final || <2.2.39.Final`, fixed in `2.3.21.Final`, `2.2.39.Final` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-20
- [Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write](https://agentprime.io/advisories/GHSA-5rfx-cp42-p624.md)
  `GHSA-5rfx-cp42-p624`, `CVE-2025-66560` · Maven `io.quarkus:quarkus-rest`: affected `<3.20.5 || >=3.21.0, <3.27.2 || >=3.30.0, <3.31.0`, fixed in `3.20.5`, `3.27.2`, `3.31.0` · CVSS 5.9 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Denial of service
- [Spinnaker vulnerable to SSRF due to improper restrictions on http from user input](https://agentprime.io/advisories/GHSA-vrjc-q2fh-6x9h.md)
  `GHSA-vrjc-q2fh-6x9h`, `CVE-2025-61916` · Maven `io.spinnaker.clouddriver:clouddriver-artifacts`: affected `<2025.1.6 || >=2025.2.0, <2025.2.3`, fixed in `2025.1.6`, `2025.2.3` · CVSS 7.9 High · Not analysed yet · Published 5 Jan 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-523
- [Apache SIS has Improper Restriction of XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-jqmr-2pg9-vfx7.md)
  `GHSA-jqmr-2pg9-vfx7`, `CVE-2025-68280` · Maven `org.apache.sis.core:sis-metadata`: affected `>=0.4, <1.6`, fixed in `1.6` · CVSS 6.5 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: XML external entities (XXE)
- [MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation](https://agentprime.io/advisories/GHSA-cw39-r4h6-8j3x.md)
  `GHSA-cw39-r4h6-8j3x`, `CVE-2026-21452` · Maven `org.msgpack:msgpack-core`: affected `<0.9.11`, fixed in `0.9.11` · CVSS 7.5 High · Not analysed yet · Published 5 Jan 2026 · Tags: Denial of service
- [Apache Kyuubi Server vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-f8r6-6222-9pvc.md)
  `GHSA-f8r6-6222-9pvc`, `CVE-2025-66518` · Maven `org.apache.kyuubi:kyuubi-server_2.12`: affected `>=1.6.0, <1.10.3`, fixed in `1.10.3` · CVSS 8.8 High · Not analysed yet · Published 5 Jan 2026 · Tags: Path traversal, CWE-27
- [Vaadin vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-7wwv-79xw-rvvg.md)
  `GHSA-7wwv-79xw-rvvg`, `CVE-2025-15022` · Maven `com.vaadin:vaadin` and 2 more: affected `>=23.1.0, <23.6.6 || >=24.0.0, <24.8.14 || >=24.9.0, <24.9.7`, fixed in `23.6.6`, `24.8.14`, `24.9.7` · CVSS 4.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Apache StreamPipes has Improper Privilege Management issue](https://agentprime.io/advisories/GHSA-5r2g-vphf-m5xc.md)
  `GHSA-5r2g-vphf-m5xc`, `CVE-2025-47411` · Maven `org.apache.streampipes:streampipes-parent`: affected `>=0.69.0, <0.98.0`, fixed in `0.98.0` · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 1 Jan 2026 · Tags: Privilege escalation
- [Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization](https://agentprime.io/advisories/GHSA-4hx9-48xh-5mxr.md)
  `GHSA-4hx9-48xh-5mxr`, `CVE-2025-13467` · Maven `org.keycloak:keycloak-ldap-federation`: affected `>=26.3.0, <26.4.6 || <26.2.11`, fixed in `26.4.6`, `26.2.11` · CVSS 5.5 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Insecure deserialization
- [Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization](https://agentprime.io/advisories/GHSA-v4p2-2w39-mhrj.md)
  `GHSA-v4p2-2w39-mhrj`, `BIT-nifi-2025-66524`, `CVE-2025-66524` · Maven `org.apache.nifi:nifi-asana-processors`: affected `>=1.20.0, <2.7.0`, fixed in `2.7.0` · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2025 · Tags: Insecure deserialization
- [Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data](https://agentprime.io/advisories/GHSA-qf7c-7r9h-mm92.md)
  `GHSA-qf7c-7r9h-mm92`, `BIT-elasticsearch-2025-68384`, `CVE-2025-68384` · Maven `org.elasticsearch.plugin:x-pack-security`: affected `<8.19.9 || >=9.0.0, <9.1.9 || >=9.2.0, <9.2.3`, fixed in `8.19.9`, `9.1.9`, `9.2.3` · CVSS 6.5 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Denial of service
- [Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation](https://agentprime.io/advisories/GHSA-gphj-4h6p-37xq.md)
  `GHSA-gphj-4h6p-37xq`, `BIT-elasticsearch-2025-68390`, `CVE-2025-68390` · Maven `org.elasticsearch.plugin:x-pack-core`: affected `<8.19.8 || >=9.0.0, <9.1.8 || >=9.2.0, <9.2.2`, fixed in `8.19.8`, `9.1.8`, `9.2.2` · CVSS 4.9 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Denial of service
- [Apache Log4j does not verify the TLS hostname in its Socket Appender](https://agentprime.io/advisories/GHSA-vc5p-v9hr-52mj.md)
  `GHSA-vc5p-v9hr-52mj`, `CVE-2025-68161` · Maven `org.apache.logging.log4j:log4j-core`: affected `>=2.0-beta9, <2.25.3`, fixed in `2.25.3` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Weak cryptography or TLS
- [Amazon S3 Encryption Client for Java has a Key Commitment Issue](https://agentprime.io/advisories/GHSA-x44p-gvrj-pj2r.md)
  `GHSA-x44p-gvrj-pj2r`, `CVE-2025-14763` · Maven `software.amazon.encryption.s3:amazon-s3-encryption-client-java`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.0 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Weak cryptography or TLS
- [jose4j is vulnerable to DoS via compressed JWE content](https://agentprime.io/advisories/GHSA-3677-xxcr-wjqv.md)
  `GHSA-3677-xxcr-wjqv`, `CVE-2024-29371` · Maven `org.bitbucket.b_c:jose4j`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 7.5 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-1259
- [ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay](https://agentprime.io/advisories/GHSA-6gvq-jcmp-8959.md)
  `GHSA-6gvq-jcmp-8959`, `CVE-2025-68113`, `GO-2025-4239`, `PKSA-5rb8-j658-qvzz`, `PYSEC-2026-1115` · Go `github.com/altcha-org/altcha-lib-go` and 6 more: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Weak cryptography or TLS, CWE-115
- [Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder](https://agentprime.io/advisories/GHSA-84h7-rjj3-6jx4.md)
  `GHSA-84h7-rjj3-6jx4`, `CVE-2025-67735` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Alpha1, <4.2.8.Final || <4.1.129.Final`, fixed in `4.2.8.Final`, `4.1.129.Final` · CVSS 6.5 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Other injection
- [Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates](https://agentprime.io/advisories/GHSA-m9gh-789g-q5pv.md)
  `GHSA-m9gh-789g-q5pv`, `BIT-elasticsearch-2025-37731`, `CVE-2025-37731` · Maven `org.elasticsearch.plugin:x-pack-core` and 1 more: affected `>=7.0.0-alpha1, <8.19.8 || >=9.0.0-beta1, <9.1.8 || >=9.2.0, <9.2.2`, fixed in `8.19.8`, `9.1.8`, `9.2.2` · CVSS 6.8 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Authentication bypass, Weak cryptography or TLS
- [snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function](https://agentprime.io/advisories/GHSA-3f8c-8h8v-p54h.md)
  `GHSA-3f8c-8h8v-p54h`, `CVE-2025-14674` · Maven `com.aizuda:snail-job`: affected `<1.7.0-beta1`, fixed in `1.7.0-beta1` · CVSS 5.3 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Other injection, CWE-707
- [aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer](https://agentprime.io/advisories/GHSA-vx9q-rhv9-3jvg.md)
  `GHSA-vx9q-rhv9-3jvg`, `CVE-2025-67721` · Maven `io.airlift:aircompressor` and 1 more: affected `<2.0.3`, fixed in `2.0.3` · CVSS 6.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Memory corruption, Information disclosure
- [Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations](https://agentprime.io/advisories/GHSA-m5gv-vj3f-6v2p.md)
  `GHSA-m5gv-vj3f-6v2p`, `CVE-2025-3586` · Maven `com.liferay:com.liferay.object.service`: affected `<1.0.96`, fixed in `1.0.96` · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Broken access control
- [Apache StreamPark: Use the user’s password as the secret key Vulnerability](https://agentprime.io/advisories/GHSA-3hg2-rh4r-8qf6.md)
  `GHSA-3hg2-rh4r-8qf6`, `CVE-2025-53960` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.7`, fixed in `2.1.7` · CVSS 5.9 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-1240
- [Apache StreamPark uses a Weak Encryption Algorithm](https://agentprime.io/advisories/GHSA-749j-2hp6-8cxm.md)
  `GHSA-749j-2hp6-8cxm`, `CVE-2025-54981` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.7`, fixed in `2.1.7` · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Weak cryptography or TLS
- [Apache StreamPark has a hard-coded encryption key](https://agentprime.io/advisories/GHSA-prv5-c2px-j9q3.md)
  `GHSA-prv5-c2px-j9q3`, `CVE-2025-54947` · Maven `org.apache.streampark:streampark`: affected `>=2.0.0, <2.1.7`, fixed in `2.1.7` · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Hard-coded credentials
- [Apache HugeGraph-Server: RAFT and deserialization vulnerability](https://agentprime.io/advisories/GHSA-q37j-3367-fwv7.md)
  `GHSA-q37j-3367-fwv7`, `CVE-2025-26866` · Maven `org.apache.hugegraph:hg-pd-core`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 8.8 High · Not analysed yet · Published 12 Dec 2025 · Tags: Insecure deserialization
- [PowerJob has a server-side request forgery vulnerability in PingPongUtils.java](https://agentprime.io/advisories/GHSA-8xqm-6fj2-hfgf.md)
  `GHSA-8xqm-6fj2-hfgf`, `CVE-2025-14518` · Maven `tech.powerjob:powerjob-common`: affected `<=5.1.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [Race condition in the Okta Java SDK](https://agentprime.io/advisories/GHSA-j5gq-897m-2rff.md)
  `GHSA-j5gq-897m-2rff`, `CVE-2025-67505` · Maven `com.okta.sdk:okta-sdk-root`: affected `>=11.0.0, <20.0.1`, fixed in `20.0.1` · CVSS 8.4 High · Not analysed yet · Published 10 Dec 2025 · Tags: Race condition
- [Improper Memory Cleanup in the Okta Java SDK](https://agentprime.io/advisories/GHSA-qhr6-6cgv-6638.md)
  `GHSA-qhr6-6cgv-6638`, `CVE-2025-66033` · Maven `com.okta.sdk:okta-sdk-root`: affected `>=21.0.0, <24.0.1`, fixed in `24.0.1` · CVSS 5.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Denial of service
- [Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-v3f3-rf6r-43x5.md)
  `GHSA-v3f3-rf6r-43x5`, `CVE-2025-67641` · Maven `io.jenkins.plugins:coverage`: affected `<2.3056`, fixed in `2.3056` · CVSS 8.0 High · Not analysed yet · Published 10 Dec 2025 · Tags: Cross-site scripting (XSS)
- [Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability](https://agentprime.io/advisories/GHSA-qxh4-j39m-qfx4.md)
  `GHSA-qxh4-j39m-qfx4`, `CVE-2025-67643` · Maven `org.jenkinsci.plugins:pipeline-reporter-by-redpen`: affected `<=1.054`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Path traversal
- [Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials](https://agentprime.io/advisories/GHSA-3fm2-hx3h-xm4v.md)
  `GHSA-3fm2-hx3h-xm4v`, `CVE-2025-67642` · Maven `com.datapipe.jenkins.plugins:hashicorp-vault-plugin`: affected `<=371`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-282
- [Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin](https://agentprime.io/advisories/GHSA-v8hg-m323-jvjq.md)
  `GHSA-v8hg-m323-jvjq`, `CVE-2025-67640` · Maven `org.jenkins-ci.plugins:git-client`: affected `<6.4.1`, fixed in `6.4.1` · CVSS 5.0 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Command injection

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI1LTEyLTEwVDE4OjMwOjI2LjAwMDAwMFoiLCJHSFNBLXY4aGctbTMyMy1qdmpxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTAxLTIxVDE1OjMxOjE2LjAwMDAwMFoiLCJHSFNBLTU5NHctMmZ3cC1qd3JjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTAxLTIxVDE1OjMxOjE2LjAwMDAwMFoiLCJHSFNBLTU5NHctMmZ3cC1qd3JjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.