# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch](https://agentprime.io/advisories/GHSA-5fvg-qwcp-r325.md)
  `GHSA-5fvg-qwcp-r325`, `CVE-2025-59060` · Maven `org.apache.ranger:ranger-nifi-registry-plugin`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 5.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Weak cryptography or TLS
- [PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages](https://agentprime.io/advisories/GHSA-8rr6-2qw5-pc7r.md)
  `GHSA-8rr6-2qw5-pc7r`, `CVE-2026-28338` · Maven `net.sourceforge.pmd:pmd-core`: affected `<7.22.0`, fixed in `7.22.0` · CVSS 6.8 Medium · Not analysed yet · Published 28 Feb 2026 · Tags: Cross-site scripting (XSS)
- [jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition](https://agentprime.io/advisories/GHSA-72hv-8253-57qq.md)
  `GHSA-72hv-8253-57qq`, `CVE-2026-18401` · Maven `com.fasterxml.jackson.core:jackson-core` and 1 more: affected `>=2.19.0, <2.21.1 || >=2.15.0, <2.18.6`, fixed in `2.21.1`, `2.18.6` · CVSS 6.9 Medium · Not analysed yet · Published 28 Feb 2026 · Tags: Denial of service
- [Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix](https://agentprime.io/advisories/GHSA-j273-m5qq-6825.md)
  `GHSA-j273-m5qq-6825`, `CVE-2026-28208` · Maven `com.github.junrar:junrar`: affected `<7.5.8`, fixed in `7.5.8` · CVSS 5.9 Medium · EPSS 0.15 · Not analysed yet · Published 27 Feb 2026 · Tags: Path traversal
- [Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes](https://agentprime.io/advisories/GHSA-v4jw-m6rm-399h.md)
  `GHSA-v4jw-m6rm-399h`, `BIT-keycloak-2026-0871`, `CVE-2026-0871` · Maven `org.keycloak:keycloak-server-spi-private`: affected `<26.5.2`, fixed in `26.5.2` · CVSS 4.9 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Privilege escalation, Broken access control
- [Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass](https://agentprime.io/advisories/GHSA-7g5x-9c4v-4w5r.md)
  `GHSA-7g5x-9c4v-4w5r`, `BIT-keycloak-2025-12150`, `CVE-2025-12150` · Maven `org.keycloak:keycloak-services`: affected `<26.4.4`, fixed in `26.4.4` · CVSS 3.1 Low · Not analysed yet · Published 27 Feb 2026 · Tags: Weak cryptography or TLS
- [Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner](https://agentprime.io/advisories/GHSA-gx6c-pv62-9mcf.md)
  `GHSA-gx6c-pv62-9mcf`, `CVE-2026-3293` · Maven `net.snowflake:snowflake-jdbc`: affected `<=4.0.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Denial of service
- [PSI Probe: Broken access control can lead to DoS](https://agentprime.io/advisories/GHSA-rx6w-2w6h-r346.md)
  `GHSA-rx6w-2w6h-r346`, `CVE-2026-3269` · Maven `com.github.psi-probe:psi-probe-core`: affected `<=5.3.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Broken access control, Denial of service
- [PSI Probe vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-429m-9874-rx9w.md)
  `GHSA-429m-9874-rx9w`, `CVE-2026-3270` · Maven `com.github.psi-probe:psi-probe-core`: affected `<=5.3.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property](https://agentprime.io/advisories/GHSA-5476-xc4j-rqcv.md)
  `GHSA-5476-xc4j-rqcv`, `CVE-2026-27830` · Maven `com.mchange:c3p0`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 8.9 High · Not analysed yet · Published 25 Feb 2026 · Tags: Code injection, Insecure deserialization
- [mchange-commons-java: Remote Code Execution via JNDI Reference Resolution](https://agentprime.io/advisories/GHSA-m2cm-222f-qw44.md)
  `GHSA-m2cm-222f-qw44`, `CVE-2026-27727` · Maven `com.mchange:mchange-commons-java`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 8.9 High · Not analysed yet · Published 25 Feb 2026 · Tags: Other injection, Insecure deserialization
- [Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm](https://agentprime.io/advisories/GHSA-c3f3-cc42-xr9v.md)
  `GHSA-c3f3-cc42-xr9v`, `CVE-2026-23552` · Maven `org.apache.camel:camel-keycloak`: affected `>=4.15.0, <4.18.0`, fixed in `4.18.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-346
- [Apache Camel Deserializes Untrusted Data in its LevelDB Component](https://agentprime.io/advisories/GHSA-429q-mrc4-38fr.md)
  `GHSA-429q-mrc4-38fr`, `CVE-2026-25747` · Maven `org.apache.camel:camel-leveldb`: affected `>=3.0.0, <4.10.9 || >=4.11.0, <4.14.5 || >=4.15.0, <4.18.0`, fixed in `4.10.9`, `4.14.5`, `4.18.0` · CVSS 8.8 High · Not analysed yet · Published 23 Feb 2026 · Tags: Insecure deserialization
- [carbon-apimgt does not properly restrict uploaded files](https://agentprime.io/advisories/GHSA-p6jf-79j3-33f3.md)
  `GHSA-p6jf-79j3-33f3`, `CVE-2025-13590` · Maven `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1`: affected `<9.32.167`, fixed in `9.32.167` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Unrestricted file upload
- [Keycloak: Missing Check on Disabled Client for Docker Registry Protocol](https://agentprime.io/advisories/GHSA-fjf4-6f34-w64q.md)
  `GHSA-fjf4-6f34-w64q`, `CVE-2026-2733` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.3`, no fixed version yet · CVSS 3.8 Low · Not analysed yet · Published 19 Feb 2026 · Tags: Broken access control
- [mingSoft MCMS does not properly restrict file uploads](https://agentprime.io/advisories/GHSA-r9wp-qq53-qvjx.md)
  `GHSA-r9wp-qq53-qvjx`, `CVE-2026-2666` · Maven `net.mingsoft:ms-mcms`: affected `<=6.1.1`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Broken access control, Unrestricted file upload
- [Jenkins has a build information disclosure vulnerability through Run Parameter](https://agentprime.io/advisories/GHSA-wfhp-qgm8-5p5c.md)
  `GHSA-wfhp-qgm8-5p5c`, `BIT-jenkins-2026-27100`, `CVE-2026-27100` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.542, <2.551 || <2.541.2`, fixed in `2.551`, `2.541.2` · CVSS 4.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure
- [Jenkins has a stored XSS vulnerability in node offline cause description](https://agentprime.io/advisories/GHSA-85h6-5m3v-gx37.md)
  `GHSA-85h6-5m3v-gx37`, `BIT-jenkins-2026-27099`, `CVE-2026-27099` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.542, <2.551 || >=2.483, <2.541.2`, fixed in `2.551`, `2.541.2` · CVSS 8.0 High · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [Apache Tomcat - Security constraint bypass with HTTP/0.9](https://agentprime.io/advisories/GHSA-qq5r-98hh-rxc9.md)
  `GHSA-qq5r-98hh-rxc9`, `BIT-tomcat-2026-24733`, `CVE-2026-24733` · Maven `org.apache.tomcat:tomcat-coyote`: affected `>=11.0.0-M1, <11.0.15 || >=10.1.0-M1, <10.1.50 || <9.0.113`, fixed in `11.0.15`, `10.1.50`, `9.0.113` · CVSS 6.5 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-20
- [Apache Tomcat has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-mgp5-rv84-w37q.md)
  `GHSA-mgp5-rv84-w37q`, `BIT-tomcat-2026-24734`, `CVE-2026-24734` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.18 || >=10.1.0-M7, <10.1.52 || >=9.0.83, <9.0.115`, fixed in `11.0.18`, `10.1.52`, `9.0.115` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: Weak cryptography or TLS, CWE-20
- [Apache Tomcat - Client certificate verification bypass](https://agentprime.io/advisories/GHSA-fpj8-gq4v-p354.md)
  `GHSA-fpj8-gq4v-p354`, `BIT-tomcat-2025-66614`, `CVE-2025-66614` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.15 || >=10.1.0-M1, <10.1.50 || >=9.0.0-M1, <9.0.113 || >=8.5.0, <=8.5.100`, fixed in `11.0.15`, `10.1.50`, `9.0.113` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Feb 2026 · Tags: Weak cryptography or TLS, CWE-20
- [Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates](https://agentprime.io/advisories/GHSA-c5w7-m8wf-xc77.md)
  `GHSA-c5w7-m8wf-xc77`, `BIT-nifi-2026-25903`, `CVE-2026-25903` · Maven `org.apache.nifi:nifi-web-api`: affected `>=1.1.0, <2.8.0`, fixed in `2.8.0` · CVSS 8.7 High · Not analysed yet · Published 17 Feb 2026 · Tags: Broken access control
- [Wildfly Elytron integration susceptible to brute force attacks via CLI](https://agentprime.io/advisories/GHSA-qhp6-6p8p-2rqh.md)
  `GHSA-qhp6-6p8p-2rqh`, `CVE-2025-23368` · Maven `org.wildfly.core:wildfly-elytron-integration`: affected `>=32.0.0.Beta1, <32.0.0.Beta3 || <31.0.3.Final`, fixed in `32.0.0.Beta3`, `31.0.3.Final` · CVSS 8.1 High · Not analysed yet · Published 13 Feb 2026 · Tags: Authentication bypass
- [Apache Avro Java SDK is Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-rp46-r563-jrc7.md)
  `GHSA-rp46-r563-jrc7`, `CVE-2025-33042`, `PYSEC-2026-26` · Maven `org.apache.avro:avro-compiler`: affected `>=1.12.0, <1.12.1 || <1.11.5`, fixed in `1.12.1`, `1.11.5` · CVSS 7.3 High · Not analysed yet · Published 13 Feb 2026 · Tags: Code injection
- [XWiki vulnerable to click-jacking through CSS injection in comments](https://agentprime.io/advisories/GHSA-74rh-c5rh-88vg.md)
  `GHSA-74rh-c5rh-88vg`, `CVE-2026-26000` · Maven `org.xwiki.platform:xwiki-platform-web`: affected `>=17.5.0, <17.9.0 || >=17.0.0-rc-1, <17.4.6 || <16.10.13`, fixed in `17.9.0`, `17.4.6`, `16.10.13` · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-1021
- [Leaky JWTs in OpenMetadata exposing highly-privileged bot users](https://agentprime.io/advisories/GHSA-pqqf-7hxm-rj5r.md)
  `GHSA-pqqf-7hxm-rj5r`, `CVE-2026-26010` · Maven `org.open-metadata:openmetadata-sdk`: affected `<1.11.8`, fixed in `1.11.8` · CVSS 7.6 High · Not analysed yet · Published 11 Feb 2026 · Tags: Privilege escalation
- [Apache Druid Vulnerable to Authentication Bypass](https://agentprime.io/advisories/GHSA-q672-hfc7-g833.md)
  `GHSA-q672-hfc7-g833`, `CVE-2026-23906` · Maven `org.apache.druid.extensions:druid-basic-security`: affected `>=0.17.0, <36.0.0`, fixed in `36.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Feb 2026 · Tags: Authentication bypass
- [Keycloak logs sensitive headers](https://agentprime.io/advisories/GHSA-gv3v-2cpp-3pmq.md)
  `GHSA-gv3v-2cpp-3pmq`, `CVE-2025-11537` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<26.5.6`, fixed in `26.5.6` · CVSS 5.0 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: Other injection
- [Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability](https://agentprime.io/advisories/GHSA-c4qc-4q9p-m9q9.md)
  `GHSA-c4qc-4q9p-m9q9`, `CVE-2026-23901` · Maven `org.apache.shiro:shiro-core`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 1.0 Low · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-208
- [Keycloak affected by improper invitation token validation](https://agentprime.io/advisories/GHSA-hcvw-475w-8g7p.md)
  `GHSA-hcvw-475w-8g7p`, `CVE-2026-1529` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.3 || <26.2.13 || >=26.3.0, <26.4.9`, fixed in `26.5.3`, `26.2.13`, `26.4.9` · CVSS 8.1 High · Not analysed yet · Published 9 Feb 2026 · Tags: Weak cryptography or TLS
- [Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService](https://agentprime.io/advisories/GHSA-fm6w-rrp3-2x4w.md)
  `GHSA-fm6w-rrp3-2x4w`, `CVE-2025-14778` · Maven `org.keycloak:keycloak-services`: affected `<26.2.13 || >=26.5.0, <26.5.3 || >=26.3.0, <26.4.9`, fixed in `26.2.13`, `26.5.3`, `26.4.9` · CVSS 5.4 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Privilege escalation
- [Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens](https://agentprime.io/advisories/GHSA-37gf-gmxv-74wv.md)
  `GHSA-37gf-gmxv-74wv`, `CVE-2026-1486` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.3 || <26.4.9`, fixed in `26.5.3`, `26.4.9` · CVSS 8.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [Apache Shiro has an Authentication Bypass](https://agentprime.io/advisories/GHSA-c244-p6m5-vqj6.md)
  `GHSA-c244-p6m5-vqj6`, `CVE-2026-23903` · Maven `org.apache.shiro:shiro-spring`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-289
- [Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log](https://agentprime.io/advisories/GHSA-xr72-g735-4vwp.md)
  `GHSA-xr72-g735-4vwp`, `BIT-neo4j-2026-1337`, `BIT-neo4j-enterprise-2026-1337`, `CVE-2026-1337` · Maven `org.neo4j:neo4j`: affected `<2026.01`, fixed in `2026.01` · CVSS 1.1 Low · Not analysed yet · Published 6 Feb 2026 · Tags: Other injection
- [Neo4j Enterprise and Community vulnerable to a potential information disclosure](https://agentprime.io/advisories/GHSA-4j3g-rwwq-4p54.md)
  `GHSA-4j3g-rwwq-4p54`, `CVE-2026-1622` · Maven `org.neo4j:neo4j`: affected `<5.26.21 || >=2025.01.0, <2026.01.3`, fixed in `5.26.21`, `2026.01.3` · CVSS 4.8 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Information disclosure
- [Apache Syncope: Reflected XSS on Enduser Login](https://agentprime.io/advisories/GHSA-v84m-gfw5-hm2w.md)
  `GHSA-v84m-gfw5-hm2w`, `CVE-2026-23794` · Maven `org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui`: affected `>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4`, fixed in `3.0.16`, `4.0.4` · CVSS 6.8 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS)
- [Apache Syncope: Console XXE on Keymaster parameters](https://agentprime.io/advisories/GHSA-73f3-rqqf-2j54.md)
  `GHSA-73f3-rqqf-2j54`, `CVE-2026-23795` · Maven `org.apache.syncope.client.idrepo:syncope-client-idrepo-console`: affected `>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4`, fixed in `3.0.16`, `4.0.4` · CVSS 4.9 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: XML external entities (XXE)
- [JinJava Bypass through ForTag leads to Arbitrary Java Execution](https://agentprime.io/advisories/GHSA-gjx9-j8f8-7j74.md)
  `GHSA-gjx9-j8f8-7j74`, `CVE-2026-25526` · Maven `com.hubspot.jinjava:jinjava`: affected `>=2.8.0, <2.8.3 || <2.7.6`, fixed in `2.8.3`, `2.7.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2026 · Tags: Code injection
- [Crafter CMS has Improper Control of Dynamically-Managed Code Resources](https://agentprime.io/advisories/GHSA-gj28-gw7w-3pxc.md)
  `GHSA-gj28-gw7w-3pxc`, `CVE-2026-1770` · Maven `org.craftercms:craftercms`: affected `>=4.0.0, <4.5.0`, fixed in `4.5.0` · CVSS 4.5 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-913
- [H2O has an External Control of File Name or Path vulnerability](https://agentprime.io/advisories/GHSA-wj3h-wx8g-x699.md)
  `GHSA-wj3h-wx8g-x699`, `CVE-2024-5986`, `PYSEC-2026-353` · Maven `ai.h2o:h2o-core` and 1 more: affected `<=3.46.0.1`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal
- [Keycloak Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/GHSA-fwhw-chw4-gh37.md)
  `GHSA-fwhw-chw4-gh37`, `CVE-2026-1518` · Maven `org.keycloak:keycloak-parent`: affected `<=26.5.2`, no fixed version yet · CVSS 2.7 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes](https://agentprime.io/advisories/GHSA-g78x-7vwx-9f58.md)
  `GHSA-g78x-7vwx-9f58`, `CVE-2025-13881` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.2 || <26.4.9`, fixed in `26.5.2`, `26.4.9` · CVSS 2.7 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Privilege escalation
- [Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names](https://agentprime.io/advisories/GHSA-33hj-rcmx-86mv.md)
  `GHSA-33hj-rcmx-86mv`, `CVE-2024-4027` · Maven `io.undertow:undertow-core`: affected `<2.2.39.Final || >=2.4.0.Alpha1, <2.4.0.Beta1 || >=2.3.0.Alpha1, <2.3.21.Final`, fixed in `2.2.39.Final`, `2.4.0.Beta1`, `2.3.21.Final` · CVSS 7.5 High · Not analysed yet · Published 30 Jan 2026 · Tags: Denial of service, CWE-20
- [jsonrpc4j has Infinite Loop in RPC Stream Writer](https://agentprime.io/advisories/GHSA-hcx3-3q5c-r5v6.md)
  `GHSA-hcx3-3q5c-r5v6`, `CVE-2026-24802` · Maven `com.github.briandilley.jsonrpc4j:jsonrpc4j`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Denial of service
- [Quick-Media Batik Codec FIX package has Code Injection vulnerability](https://agentprime.io/advisories/GHSA-8623-9fwr-4cxv.md)
  `GHSA-8623-9fwr-4cxv`, `CVE-2026-24806` · Maven `com.github.liuyueyi.media:batik-codec-fix`: affected `<=3.0.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection
- [weixin4j has Improperly Controlled Sequential Memory Allocation](https://agentprime.io/advisories/GHSA-444m-px7r-qpvv.md)
  `GHSA-444m-px7r-qpvv`, `CVE-2026-24819` · Maven `com.foxinmy:weixin4j-base`: affected `<=1.10.2`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-1325
- [Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec](https://agentprime.io/advisories/GHSA-23f4-hfmq-94mj.md)
  `GHSA-23f4-hfmq-94mj`, `CVE-2026-24807` · Maven `com.github.liuyueyi.media:batik-codec-fix`: affected `<=3.0.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Weak cryptography or TLS
- [AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion](https://agentprime.io/advisories/GHSA-rqfh-9r24-8c9r.md)
  `GHSA-rqfh-9r24-8c9r`, `CVE-2026-24400` · Maven `org.assertj:assertj-core`: affected `>=1.4.0, <3.27.7`, fixed in `3.27.7` · CVSS 8.2 High · Not analysed yet · Published 26 Jan 2026 · Tags: XML external entities (XXE)
- [Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion](https://agentprime.io/advisories/GHSA-frpp-8pwq-hjrx.md)
  `GHSA-frpp-8pwq-hjrx`, `CVE-2025-14969` · Maven `org.hibernate.reactive:hibernate-reactive-core`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 4.3 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Denial of service
- [Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods](https://agentprime.io/advisories/GHSA-63v5-26vq-m4vm.md)
  `GHSA-63v5-26vq-m4vm`, `CVE-2026-1190` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.2`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 26 Jan 2026 · Tags: Weak cryptography or TLS, Authentication bypass, CWE-112
- [Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector](https://agentprime.io/advisories/GHSA-jmw5-58c7-587h.md)
  `GHSA-jmw5-58c7-587h`, `CVE-2026-24656` · Maven `org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 3.7 Low · Not analysed yet · Published 26 Jan 2026 · Tags: Insecure deserialization
- [Apache Continuum vulnerable to Command Injection through Installations REST API](https://agentprime.io/advisories/GHSA-77p9-w6pj-rmvg.md)
  `GHSA-77p9-w6pj-rmvg`, `CVE-2016-15057` · Maven `org.apache.continuum:continuum`: affected `<=1.4.2`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Command injection
- [Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability](https://agentprime.io/advisories/GHSA-92cc-952p-v8rh.md)
  `GHSA-92cc-952p-v8rh`, `CVE-2025-27821` · Maven `org.apache.hadoop:hadoop-hdfs-native-client`: affected `>=3.2.0, <3.4.2`, fixed in `3.4.2` · CVSS 7.3 High · Not analysed yet · Published 26 Jan 2026 · Tags: Memory corruption
- [XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages](https://agentprime.io/advisories/GHSA-wvqx-m5px-6cmp.md)
  `GHSA-wvqx-m5px-6cmp`, `CVE-2026-24128` · Maven `org.xwiki.platform:xwiki-platform-web-templates`: affected `>=7.0-milestone-2, <16.10.12 || >=17.0.0-rc-1, <17.4.5 || >=17.5.0-rc-1, <17.8.0-rc-1`, fixed in `16.10.12`, `17.4.5`, `17.8.0-rc-1` · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Hibernate vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-2p5w-cvg5-gc5c.md)
  `GHSA-2p5w-cvg5-gc5c`, `CVE-2026-0603` · Maven `org.hibernate:hibernate-core`: affected `>=5.2.8, <5.3.38`, fixed in `5.3.38` · CVSS 8.3 High · Not analysed yet · Published 23 Jan 2026 · Tags: SQL injection
- [Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide](https://agentprime.io/advisories/GHSA-vqxh-445g-37fc.md)
  `GHSA-vqxh-445g-37fc`, `CVE-2025-22234` · Maven `org.springframework.security:spring-security-core`: affected `>=6.3.8, <6.3.9 || >=6.4.4, <6.4.5`, fixed in `6.3.9`, `6.4.5` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-208
- [Logback allows an attacker to instantiate classes already present on the class path](https://agentprime.io/advisories/GHSA-qqpg-mvqg-649v.md)
  `GHSA-qqpg-mvqg-649v`, `CVE-2026-1225` · Maven `ch.qos.logback:logback-core`: affected `<1.5.25`, fixed in `1.5.25` · CVSS 1.8 Low · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-20
- [Apache Solr: Insufficient file-access checking in standalone core-creation requests](https://agentprime.io/advisories/GHSA-vc2w-4v3p-2mqw.md)
  `GHSA-vc2w-4v3p-2mqw`, `BIT-solr-2026-22444`, `CVE-2026-22444` · Maven `org.apache.solr:solr-core`: affected `>=8.6.0, <9.10.1`, fixed in `9.10.1` · CVSS 7.1 High · Not analysed yet · Published 21 Jan 2026 · Tags: CWE-20
- [Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin](https://agentprime.io/advisories/GHSA-qr3p-2xj2-q7hq.md)
  `GHSA-qr3p-2xj2-q7hq`, `BIT-solr-2026-22022`, `CVE-2026-22022` · Maven `org.apache.solr:solr-core`: affected `>=5.3.0, <9.10.1`, fixed in `9.10.1` · CVSS 8.2 High · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control
- [Keycloak Admin REST API exposes backend schema and rules](https://agentprime.io/advisories/GHSA-594w-2fwp-jwrc.md)
  `GHSA-594w-2fwp-jwrc`, `CVE-2025-14083` · Maven `org.keycloak:keycloak-services`: affected `<=26.2.5`, no fixed version yet · CVSS 2.7 Low · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTAxLTIxVDE1OjMxOjE2LjAwMDAwMFoiLCJHSFNBLTU5NHctMmZ3cC1qd3JjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTAzLTAzVDEyOjMxOjI3LjAwMDAwMFoiLCJHSFNBLWM4N3ctNjQyaC1tOTdoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTAzLTAzVDEyOjMxOjI3LjAwMDAwMFoiLCJHSFNBLWM4N3ctNjQyaC1tOTdoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.