# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key](https://agentprime.io/advisories/GHSA-fvh3-672c-7p6c.md)
  `GHSA-fvh3-672c-7p6c`, `CVE-2026-22738` · Maven `org.springframework.ai:spring-ai-vector-store`: affected `>=1.0.0, <1.0.5 || >=1.1.0-M1, <1.1.4`, fixed in `1.0.5`, `1.1.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Mar 2026 · Tags: Command injection, Code injection
- [Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure](https://agentprime.io/advisories/GHSA-q35r-vvhv-vx5h.md)
  `GHSA-q35r-vvhv-vx5h`, `CVE-2026-3190` · Maven `org.keycloak:keycloak-model-jpa` and 2 more: affected `<26.5.6`, fixed in `26.5.6` · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-280
- [Keycloak: manage-clients permission escalates to full realm admin access](https://agentprime.io/advisories/GHSA-7xf9-4jfc-wgm4.md)
  `GHSA-7xf9-4jfc-wgm4`, `CVE-2026-3121` · Maven `org.keycloak:keycloak-services`: affected `<26.5.6`, fixed in `26.5.6` · CVSS 6.5 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Privilege escalation
- [Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass](https://agentprime.io/advisories/GHSA-w9fj-cfpg-grvv.md)
  `GHSA-w9fj-cfpg-grvv`, `CVE-2026-33871` · Maven `io.netty:netty-codec-http2`: affected `<4.1.132.Final || >=4.2.0.Alpha1, <4.2.11.Final`, fixed in `4.1.132.Final`, `4.2.11.Final` · CVSS 8.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: Denial of service
- [Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing](https://agentprime.io/advisories/GHSA-pwqr-wmgm-9rr8.md)
  `GHSA-pwqr-wmgm-9rr8`, `CVE-2026-33870` · Maven `io.netty:netty-codec-http`: affected `<4.1.132.Final || >=4.2.0.Alpha1, <4.2.10.Final`, fixed in `4.1.132.Final`, `4.2.10.Final` · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2026 · Tags: HTTP request smuggling
- [splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-h8w2-rv57-vc6f.md)
  `GHSA-h8w2-rv57-vc6f` · Maven `com.splunk:splunk-otel-javaagent`: affected `<2.26.1`, fixed in `2.26.1` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization, CWE-1395
- [dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution](https://agentprime.io/advisories/GHSA-579q-h82j-r5v2.md)
  `GHSA-579q-h82j-r5v2`, `CVE-2026-33728` · Maven `com.datadoghq:dd-java-agent`: affected `>=0.40.0, <1.60.3`, fixed in `1.60.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization
- [Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation](https://agentprime.io/advisories/GHSA-22rm-wp4x-v5cx.md)
  `GHSA-22rm-wp4x-v5cx`, `CVE-2026-4874` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.6.3 || <26.4.13`, fixed in `26.6.3`, `26.4.13` · CVSS 3.1 Low · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names](https://agentprime.io/advisories/GHSA-5458-7hh9-v7p4.md)
  `GHSA-5458-7hh9-v7p4`, `CVE-2025-70952` · Maven `org.pf4j:pf4j`: affected `<3.14.1`, fixed in `3.14.1` · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2026 · Tags: Path traversal
- [OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-xw7x-h9fj-p2c7.md)
  `GHSA-xw7x-h9fj-p2c7`, `CVE-2026-33701` · Maven `io.opentelemetry.javaagent:opentelemetry-javaagent`: affected `<2.26.1`, fixed in `2.26.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Insecure deserialization
- [Plexus-Utils has a Directory Traversal vulnerability in its extractFile method](https://agentprime.io/advisories/GHSA-6fmv-xxpf-w3cw.md)
  `GHSA-6fmv-xxpf-w3cw`, `CVE-2025-67030` · Maven `org.codehaus.plexus:plexus-utils`: affected `>=4.0.0, <4.0.3 || <3.6.1`, fixed in `4.0.3`, `3.6.1` · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: Path traversal
- [sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows](https://agentprime.io/advisories/GHSA-x4ff-q6h8-v7gw.md)
  `GHSA-x4ff-q6h8-v7gw`, `CVE-2026-32948` · Maven `org.scala-sbt:sbt`: affected `>=0.9.5, <1.12.8`, fixed in `1.12.8` · CVSS 6.7 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Command injection
- [Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol](https://agentprime.io/advisories/GHSA-f4gc-mwrg-q36r.md)
  `GHSA-f4gc-mwrg-q36r`, `CVE-2026-32642` · Maven `org.apache.activemq:artemis-openwire-protocol` and 1 more: affected `>=2.0.0, <2.53.0`, fixed in `2.53.0` · CVSS 2.3 Low · Not analysed yet · Published 24 Mar 2026 · Tags: Broken access control
- [Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests](https://agentprime.io/advisories/GHSA-3x3v-w654-m28m.md)
  `GHSA-3x3v-w654-m28m`, `CVE-2026-3260` · Maven `io.undertow:undertow-core`: affected `*`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access](https://agentprime.io/advisories/GHSA-3qwq-q9vm-5j42.md)
  `GHSA-3qwq-q9vm-5j42`, `CVE-2026-22739` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `>=4.3.0, <4.3.2 || >=5.0.0-M1, <5.0.2 || >=4.2.0, <=4.2.4 || >=4.0.0, <=4.1.7 || <=3.1.10`, fixed in `4.3.2`, `5.0.2` · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2026 · Tags: Path traversal
- [Keycloak's identity-first login flow exposes user information](https://agentprime.io/advisories/GHSA-rhgq-f8x5-j2jc.md)
  `GHSA-rhgq-f8x5-j2jc`, `CVE-2026-4633` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.6.1 || <26.4.12`, fixed in `26.6.1`, `26.4.12` · CVSS 3.7 Low · Not analysed yet · Published 23 Mar 2026 · Tags: Information disclosure
- [Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false](https://agentprime.io/advisories/GHSA-4pgc-gfrr-wcmg.md)
  `GHSA-4pgc-gfrr-wcmg`, `CVE-2026-4628` · Maven `org.keycloak:keycloak-services`: affected `<=26.6.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Broken access control
- [Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints](https://agentprime.io/advisories/GHSA-mgvc-8q2h-5pgc.md)
  `GHSA-mgvc-8q2h-5pgc`, `CVE-2026-22733` · Maven `org.springframework.boot:spring-boot-starter-actuator`: affected `>=4.0.0-M1, <4.0.4 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.13 || >=3.0.0, <=3.3.13 || <=2.7.18`, fixed in `4.0.4`, `3.5.12` · CVSS 8.2 High · Not analysed yet · Published 20 Mar 2026 · Tags: Authentication bypass
- [Spring Security HTTP Headers Are not Written Under Some Conditions](https://agentprime.io/advisories/GHSA-mf92-479x-3373.md)
  `GHSA-mf92-479x-3373`, `CVE-2026-22732` · Maven `org.springframework.security:spring-security-web`: affected `<=5.7.14 || >=5.8.0, <=5.8.16 || >=6.0.0, <=6.3.10 || >=6.4.0, <=6.4.13 || >=6.5.0, <6.5.9 || >=7.0.0, <7.0.4`, fixed in `6.5.9`, `7.0.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Broken access control
- [Spring Boot has an Authentication Bypass under Actuator Health groups paths](https://agentprime.io/advisories/GHSA-8hfc-fq58-r658.md)
  `GHSA-8hfc-fq58-r658`, `CVE-2026-22731` · Maven `org.springframework.boot:spring-boot-starter-actuator`: affected `>=3.4.0, <=3.4.13 || >=3.5.0, <3.5.12 || >=4.0.0-M1, <4.0.4`, fixed in `3.5.12`, `4.0.4` · CVSS 8.2 High · Not analysed yet · Published 20 Mar 2026 · Tags: Authentication bypass
- [Spring MVC and WebFlux has Server Sent Event stream corruption](https://agentprime.io/advisories/GHSA-6hcq-hmm3-jj3c.md)
  `GHSA-6hcq-hmm3-jj3c`, `CVE-2026-22735` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0-M1, <7.0.6 || >=6.2.0, <6.2.17 || >=6.0.0, <=6.1.21 || >=5.3.0, <=5.3.39`, fixed in `7.0.6`, `6.2.17` · CVSS 2.6 Low · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-667
- [Spring Framework Improper Path Limitation with Script View Templates](https://agentprime.io/advisories/GHSA-4773-3jfm-qmx3.md)
  `GHSA-4773-3jfm-qmx3`, `CVE-2026-22737` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0-M1, <7.0.6 || >=6.2.0, <6.2.17 || >=6.0.0, <=6.1.21 || >=5.3.0, <=5.3.39`, fixed in `7.0.6`, `6.2.17` · CVSS 5.9 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Path traversal
- [HAPI FHIR HTTP authentication leak in redirects](https://agentprime.io/advisories/GHSA-p7m9-v2cm-2h7m.md)
  `GHSA-p7m9-v2cm-2h7m`, `CVE-2026-33180` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.convertors` and 11 more: affected `<6.9.0`, fixed in `6.9.0` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: Information disclosure
- [Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)](https://agentprime.io/advisories/GHSA-64hm-gfwq-jppw.md)
  `GHSA-64hm-gfwq-jppw`, `CVE-2026-33166` · Maven `io.qameta.allure:allure-generator`: affected `<2.38.0`, fixed in `2.38.0` · CVSS 8.6 High · Not analysed yet · Published 18 Mar 2026 · Tags: Path traversal
- [Jenkins has a link following vulnerability allows arbitrary file creation](https://agentprime.io/advisories/GHSA-r6qv-frpc-q66c.md)
  `GHSA-r6qv-frpc-q66c`, `BIT-jenkins-2026-33001`, `CVE-2026-33001` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555`, fixed in `2.555` · CVSS 8.8 High · Not analysed yet · Published 18 Mar 2026 · Tags: Path traversal, CWE-61
- [Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files](https://agentprime.io/advisories/GHSA-qqjr-hf5h-jx3q.md)
  `GHSA-qqjr-hf5h-jx3q`, `CVE-2026-33003` · Maven `org.jenkins-ci.plugins:loadninja`: affected `<2.2`, fixed in `2.2` · CVSS 4.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Information disclosure
- [Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation](https://agentprime.io/advisories/GHSA-phhv-63fh-rrc8.md)
  `GHSA-phhv-63fh-rrc8`, `BIT-jenkins-2026-33002`, `CVE-2026-33002` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.442, <2.555`, fixed in `2.555` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-346, CWE-350
- [Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form](https://agentprime.io/advisories/GHSA-p9hg-wrmv-v8cp.md)
  `GHSA-p9hg-wrmv-v8cp`, `CVE-2026-33004` · Maven `org.jenkins-ci.plugins:loadninja`: affected `<2.2`, fixed in `2.2` · CVSS 4.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Information disclosure
- [SQL Injection in Spring AI MariaDBFilterExpressionConverter](https://agentprime.io/advisories/GHSA-c267-rfvc-mvpm.md)
  `GHSA-c267-rfvc-mvpm`, `CVE-2026-22730` · Maven `org.springframework.ai:spring-ai-mariadb-store`: affected `>=1.1.0-M1, <1.1.3 || <1.0.4`, fixed in `1.1.3`, `1.0.4` · CVSS 8.8 High · Not analysed yet · Published 18 Mar 2026 · Tags: SQL injection
- [JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter](https://agentprime.io/advisories/GHSA-rp9g-qx29-88cp.md)
  `GHSA-rp9g-qx29-88cp`, `CVE-2026-22729` · Maven `org.springframework.ai:spring-ai-vector-store`: affected `>=1.1.0-M1, <1.1.3 || <1.0.4`, fixed in `1.1.3`, `1.0.4` · CVSS 8.6 High · Not analysed yet · Published 18 Mar 2026 · Tags: Code injection
- [Keycloak: Denial of Service due to excessive SAMLRequest decompression](https://agentprime.io/advisories/GHSA-xv6h-r36f-3gp5.md)
  `GHSA-xv6h-r36f-3gp5`, `BIT-keycloak-2026-2575`, `CVE-2026-2575` · Maven `org.keycloak:keycloak-saml-adapter-core` and 2 more: affected `<26.5.4`, fixed in `26.5.4` · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-409
- [Keycloak: Unauthorized authentication via disabled SAML Identity Provider](https://agentprime.io/advisories/GHSA-x4p7-7chp-64hq.md)
  `GHSA-x4p7-7chp-64hq`, `BIT-keycloak-2026-2603`, `CVE-2026-2603` · Maven `org.keycloak:keycloak-server-spi-private` and 1 more: affected `<26.5.5`, fixed in `26.5.5` · CVSS 8.1 High · Not analysed yet · Published 18 Mar 2026 · Tags: Authentication bypass
- [Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions](https://agentprime.io/advisories/GHSA-wmxr-6j5f-838p.md)
  `GHSA-wmxr-6j5f-838p` · Maven `org.keycloak:keycloak-saml-adapter-core` and 2 more: affected `<26.2.14 || >=26.3.0, <26.4.10 || >=26.5.0, <26.5.5`, fixed in `26.2.14`, `26.4.10`, `26.5.5` · CVSS 7.7 High · Withdrawn · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-1287
- [Micronaut Framework vulnerable to a Denial of Service in HTML error response caching](https://agentprime.io/advisories/GHSA-2hcp-gjrf-7fhc.md)
  `GHSA-2hcp-gjrf-7fhc`, `CVE-2026-33012` · Maven `io.micronaut:micronaut-http-server`: affected `>=4.7.0, <4.10.17`, fixed in `4.10.17` · CVSS 7.5 High · Not analysed yet · Published 17 Mar 2026 · Tags: Denial of service
- [Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices](https://agentprime.io/advisories/GHSA-43w5-mmxv-cpvh.md)
  `GHSA-43w5-mmxv-cpvh`, `CVE-2026-33013` · Maven `io.micronaut:micronaut-json-core`: affected `>=4.0.0-M1, <4.10.16 || >=3.9.0, <3.10.5 || <3.8.13`, fixed in `4.10.16`, `3.10.5`, `3.8.13` · CVSS 8.2 High · Not analysed yet · Published 17 Mar 2026 · Tags: Denial of service
- [Apache Spark: Spark History Server Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-jwp6-cvj8-fw65.md)
  `GHSA-jwp6-cvj8-fw65`, `BIT-spark-2025-54920`, `CVE-2025-54920` · Maven `org.apache.spark:spark-core_2.10` and 4 more: affected `<=2.2.3`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 16 Mar 2026 · Tags: Insecure deserialization
- [Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames](https://agentprime.io/advisories/GHSA-8r8j-gfhg-fw38.md)
  `GHSA-8r8j-gfhg-fw38`, `CVE-2026-25534` · Maven `io.spinnaker.clouddriver:clouddriver-artifacts` and 1 more: affected `>=2025.1.6, <2025.2.4 || >=2025.3.0, <2025.3.1 || >=2025.4.0, <2025.4.1`, fixed in `2025.2.4`, `2025.3.1`, `2025.4.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Livy: Restrict file access](https://agentprime.io/advisories/GHSA-hm8x-rpgg-7855.md)
  `GHSA-hm8x-rpgg-7855`, `CVE-2025-60012` · Maven `org.apache.livy:livy-server`: affected `>=0.7.0-incubating, <0.9.0-incubating`, fixed in `0.9.0-incubating` · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-20
- [Apache Livy: Unauthorized directory access](https://agentprime.io/advisories/GHSA-h84f-4ff9-8hc3.md)
  `GHSA-h84f-4ff9-8hc3`, `CVE-2025-66249` · Maven `org.apache.livy:livy-server`: affected `>=0.3.0-incubating, <0.9.0-incubating`, fixed in `0.9.0-incubating` · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Path traversal
- [Keycloak vulnerable to authorization bypass via the Admin API](https://agentprime.io/advisories/GHSA-r8jr-wg88-fq5c.md)
  `GHSA-r8jr-wg88-fq5c`, `BIT-keycloak-2026-2366`, `CVE-2026-2366` · Maven `org.keycloak:keycloak-js-admin-client` and 1 more: affected `<=26.5.5`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 12 Mar 2026 · Tags: Broken access control
- [Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API](https://agentprime.io/advisories/GHSA-8g9r-9wjw-37j4.md)
  `GHSA-8g9r-9wjw-37j4`, `BIT-keycloak-2026-3429`, `CVE-2026-3429` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.6`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control
- [Keycloak: Information disclosure of disabled user attributes via administrative endpoint](https://agentprime.io/advisories/GHSA-xh32-c9wx-phrp.md)
  `GHSA-xh32-c9wx-phrp`, `BIT-keycloak-2026-3911`, `CVE-2026-3911` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.5`, no fixed version yet · CVSS 2.7 Low · Not analysed yet · Published 11 Mar 2026 · Tags: Information disclosure
- [Vaadin: Specially crafted ZIP archives can escape the intended extraction directory](https://agentprime.io/advisories/GHSA-8jrh-7jg8-fvmv.md)
  `GHSA-8jrh-7jg8-fvmv`, `CVE-2026-2741` · Maven `com.vaadin:flow-project`: affected `>=14.2.0, <14.14.1 || >=23.0.0, <23.6.7 || >=24.0.0, <24.9.9 || >=25.0.0, <25.0.3`, fixed in `14.14.1`, `23.6.7`, `24.9.9`, `25.0.3` · CVSS 2.3 Low · Not analysed yet · Published 10 Mar 2026 · Tags: Path traversal
- [Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash](https://agentprime.io/advisories/GHSA-rjgh-wgc7-m37j.md)
  `GHSA-rjgh-wgc7-m37j`, `CVE-2026-2742` · Maven `com.vaadin:flow-server` and 1 more: affected `<14.14.1 || >=23.0.0, <23.6.7 || >=24.0.0, <24.9.8 || >=25.0.0, <25.0.2`, fixed in `14.14.1`, `23.6.7`, `24.9.8`, `25.0.2` · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Broken access control
- [Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function](https://agentprime.io/advisories/GHSA-jjwr-xmw6-gf78.md)
  `GHSA-jjwr-xmw6-gf78`, `CVE-2026-23907` · Maven `org.apache.pdfbox:pdfbox-examples`: affected `>=2.0.24, <3.0.7`, fixed in `3.0.7` · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Path traversal
- [Apache IoTDB has an Insecure Default Configuration Vulnerability](https://agentprime.io/advisories/GHSA-74cf-pgh9-m5q2.md)
  `GHSA-74cf-pgh9-m5q2`, `CVE-2026-24015` · Maven `org.apache.iotdb:iotdb-core`: affected `>=1.0.0, <1.3.7 || >=2.0.0, <2.0.7`, fixed in `1.3.7`, `2.0.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-1327
- [Apache IoTDB has an Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-6w48-2g9j-v9q5.md)
  `GHSA-6w48-2g9j-v9q5`, `CVE-2026-24713` · Maven `org.apache.iotdb:iotdb-core`: affected `>=1.0.0, <1.3.7 || >=2.0.0, <2.0.7`, fixed in `1.3.7`, `2.0.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Mar 2026 · Tags: Code injection, CWE-20
- [Apache ZooKeeper has improper handling of configuration values](https://agentprime.io/advisories/GHSA-crhr-qqj8-rpxc.md)
  `GHSA-crhr-qqj8-rpxc`, `BIT-zookeeper-2026-24308`, `CVE-2026-24308` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.9.0, <3.9.5 || >=3.8.0, <3.8.6`, fixed in `3.9.5`, `3.8.6` · CVSS 6.5 Medium · Not analysed yet · Published 7 Mar 2026 · Tags: Other injection, Information disclosure
- [Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager](https://agentprime.io/advisories/GHSA-7xrh-hqfc-g7qr.md)
  `GHSA-7xrh-hqfc-g7qr`, `BIT-zookeeper-2026-24281`, `CVE-2026-24281` · Maven `org.apache.zookeeper:zookeeper`: affected `>=3.8.0, <3.8.6 || >=3.9.0, <3.9.5`, fixed in `3.8.6`, `3.9.5` · CVSS 7.4 High · Not analysed yet · Published 7 Mar 2026 · Tags: Weak cryptography or TLS, CWE-350
- [org.eclipse.jetty:jetty-http has different parsing of invalid URIs](https://agentprime.io/advisories/GHSA-wjpw-4j6x-6rwh.md)
  `GHSA-wjpw-4j6x-6rwh`, `CVE-2025-11143` · Maven `org.eclipse.jetty:jetty-http`: affected `>=9.4.0, <=9.4.58 || >=10.0.0, <=10.0.26 || >=11.0.0, <=11.0.26 || >=12.0.0, <12.0.31 || >=12.1.0, <12.1.5`, fixed in `12.0.31`, `12.1.5` · CVSS 3.7 Low · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-20
- [Cloudfoundry UAA has logic error in the token revocation endpoint implementation](https://agentprime.io/advisories/GHSA-6wcw-r64p-qrrw.md)
  `GHSA-6wcw-r64p-qrrw`, `CVE-2026-22723` · Maven `org.cloudfoundry.identity:cloudfoundry-identity-server`: affected `>=77.30.0, <78.8.0`, fixed in `78.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-640, CWE-693
- [Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator](https://agentprime.io/advisories/GHSA-m297-3jv9-m927.md)
  `GHSA-m297-3jv9-m927`, `BIT-keycloak-2026-3009`, `CVE-2026-3009` · Maven `org.keycloak:keycloak-services`: affected `<26.5.5`, fixed in `26.5.5` · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: Broken access control
- [Keycloak SAML Broken has Authentication Bypass by Primary Weakness](https://agentprime.io/advisories/GHSA-8cr3-vpxx-92cx.md)
  `GHSA-8cr3-vpxx-92cx`, `BIT-keycloak-2026-3047`, `CVE-2026-3047` · Maven `org.keycloak:keycloak-broker-saml`: affected `<=1.8.1.Final`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-305
- [The Eclipse Jetty Server Artifact has a Gzip request memory leak](https://agentprime.io/advisories/GHSA-xxh7-fcf3-rj7f.md)
  `GHSA-xxh7-fcf3-rj7f`, `CVE-2026-1605` · Maven `org.eclipse.jetty:jetty-server`: affected `>=12.1.0, <12.1.6 || >=12.0.0, <12.0.32`, fixed in `12.1.6`, `12.0.32` · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: Denial of service
- [pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT](https://agentprime.io/advisories/GHSA-pm7g-w2cf-q238.md)
  `GHSA-pm7g-w2cf-q238`, `CVE-2026-29000` · Maven `org.pac4j:pac4j-jwt`: affected `>=6.0.4.1, <6.3.3 || >=5.0.0-RC1, <5.7.9 || <4.5.9`, fixed in `6.3.3`, `5.7.9`, `4.5.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Weak cryptography or TLS
- [jackson-core has Nesting Depth Constraint Bypass in \`UTF8DataInputJsonParser\` potentially allowing Resource Exhaustion](https://agentprime.io/advisories/GHSA-6v53-7c9g-w56r.md)
  `GHSA-6v53-7c9g-w56r`, `CVE-2026-29062` · Maven `tools.jackson.core:jackson-core`: affected `>=3.0.0, <3.1.0`, fixed in `3.1.0` · CVSS 8.7 High · Not analysed yet · Published 4 Mar 2026 · Tags: Denial of service, CWE-1284
- [XWiki Blog Application home page vulnerable to Stored XSS via Post Title](https://agentprime.io/advisories/GHSA-h2xq-h7f9-vh6c.md)
  `GHSA-h2xq-h7f9-vh6c`, `CVE-2025-66024` · Maven `org.xwiki.contrib.blog:application-blog-ui`: affected `>=9.15, <9.15.7`, fixed in `9.15.7` · CVSS 8.6 High · Not analysed yet · Published 4 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions](https://agentprime.io/advisories/GHSA-fw88-pf9m-p947.md)
  `GHSA-fw88-pf9m-p947`, `CVE-2026-27446` · Maven `org.apache.activemq:artemis-server` and 1 more: affected `>=2.11.0, <=2.44.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 4 Mar 2026 · Tags: Authentication bypass
- [Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound](https://agentprime.io/advisories/GHSA-c825-6ph3-4h84.md)
  `GHSA-c825-6ph3-4h84`, `BIT-activemq-2025-66168`, `CVE-2025-66168` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.2 || >=6.0.0, <6.1.9 || >=6.2.0, <6.2.1`, fixed in `5.19.2`, `6.1.9`, `6.2.1` · CVSS 5.4 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: Memory corruption
- [Apache Ranger has a Code Injection vulnerability](https://agentprime.io/advisories/GHSA-c87w-642h-m97h.md)
  `GHSA-c87w-642h-m97h`, `CVE-2025-59059` · Maven `org.apache.ranger:ranger-plugins-common`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTAzLTAzVDEyOjMxOjI3LjAwMDAwMFoiLCJHSFNBLWM4N3ctNjQyaC1tOTdoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTAzLTI3VDA2OjMxOjQzLjAwMDAwMFoiLCJHSFNBLTQ0ZjQtZ3Z3ai02cWczIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTAzLTI3VDA2OjMxOjQzLjAwMDAwMFoiLCJHSFNBLTQ0ZjQtZ3Z3ai02cWczIl0>. Everything for agents: <https://agentprime.io/llms.txt>.