Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 8.8 High
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
- Code injection
<2.5.4 · fixed in 2.5.4
GHSA-4vjp-327p-w4qv · CVE-2025-31722 - CVSS 4.3 Medium
Jenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job `config.xml` Files
- Broken access control
- Information disclosure
<=1.0.6 · no fixed version yet
GHSA-2wxq-944j-5g2v · CVE-2025-31726 - CVSS 8.8 High
jooby-pac4j: deserialization of untrusted data
- Insecure deserialization
<2.17.0 || >=3.0.0.M1, <3.7.0 · fixed in 2.17.0, 3.7.0
GHSA-7c5v-895v-w4q5 · CVE-2025-31129 - CVSS 6.5 Medium
Apache Camel Missing Header Out Filter Leads to Potential Bypass/Injection Vulnerability
- CWE-164
>=4.10.0, <4.10.3 || >=4.8.0, <4.8.6 · fixed in 4.10.3, 4.8.6
GHSA-vq4p-pchp-6g6v · CVE-2025-30177 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Apache Pinot Vulnerable to Authentication Bypass
- Authentication bypass
>=0.8.0, <1.3.0 · fixed in 1.3.0
GHSA-6jwp-4wvj-6597 · CVE-2024-56325 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
- Insecure deserialization
<1.15.1 · fixed in 1.15.1
GHSA-2c59-37c4-qrx5 · CVE-2025-30065 - CVSS 2.3 Low
Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
- Broken access control
>=2.0.0, <2.40.0 · fixed in 2.40.0
GHSA-3w85-5p9g-h334 · CVE-2025-27427 - CVSS 5.3 Medium
Netty QUIC hash collision DoS attack
- Denial of service
<0.0.71.Final · fixed in 0.0.71.Final
GHSA-hqqc-jr88-p6x2 · CVE-2025-29908 - CVSS 5.3 Medium
Solon Vulnerable to Path Traversal
- Path traversal
<=3.1.0 · no fixed version yet
GHSA-2m4q-2c6r-hmc3 · CVE-2025-2961 - CVSS 6.5 Medium
Infinispan Potential Out of Memory Error via REST Compare API Buffer API
- Denial of service
<=15.0.5.Final · no fixed version yet
GHSA-2q39-w2hw-2pjm · CVE-2024-6875 - CVSS 4.6 Medium
Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store
- Cross-site scripting (XSS)
<3.7.11.Final · fixed in 3.7.11.Final
GHSA-hp88-hfjw-2hg4 - CVSS 7.2 High
Apache Kylin Code Injection via JDBC Configuration Alteration
- Code injection
>=4.0.0, <5.0.2 · fixed in 5.0.2
GHSA-29m8-wh9p-5wc4 · CVE-2025-30067 - CVSS 6.5 Medium
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint
- Server-side request forgery (SSRF)
>=5.0.0, <5.0.2 · fixed in 5.0.2
GHSA-3v67-545x-ffc3 · CVE-2024-48944 - CVSS 4.2 Medium
WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack
- CWE-345
>=1.17.0.Final, <2.2.9.Final || >=2.3.0.Final, <2.6.2.Final · fixed in 2.2.9.Final, 2.6.2.Final
GHSA-5565-3c98-g6jc · CVE-2024-12369 - CVSS 4.9 Medium
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache
- Denial of service
<=26.1.4 · no fixed version yet
GHSA-2935-2wfm-hhpv · CVE-2025-2559 - CVSS 8.1 High
OpenDaylight SFC Insecure Shiro Cookie Configuration
- Weak cryptography or TLS
<=0.10.4 · no fixed version yet
GHSA-xp75-w7vq-5x6j · CVE-2025-29314 - CVSS 9.8 CriticalCritical · CVSS 9+
OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
- Broken access control
<=0.10.4 · no fixed version yet
GHSA-x65v-g96x-c6gw · CVE-2025-29315 - CVSS 7.5 High
OpenDaylight SFC Denial of Service (DoS)
- Denial of service
<=0.10.4 · no fixed version yet
GHSA-v3vp-fg2v-g7q4 · CVE-2025-29313 - CVSS 5.3 Medium
Spring Security Vulnerable to Authorization Bypass via Security Annotations
- Authentication bypass
>=6.4.0, <6.4.4 · fixed in 6.4.4
GHSA-hh3m-g4qj-4835 · CVE-2025-22223 - CVSS 7.5 High
Apache Commons VFS Has Relative Path Traversal Vulnerability
- Path traversal
<2.10.0 · fixed in 2.10.0
GHSA-9q4x-fr4m-jp86 · CVE-2025-27553 - CVSS 5.0 Medium
Apache Commons VFS Exposure of Sensitive Information to an Unauthorized Actor
- Information disclosure
<2.10.0 · fixed in 2.10.0
GHSA-3936-3gx6-49c4 · CVE-2025-30474 - CVSS 5.3 Medium
aizuda snail-job Vulnerable to Deserialization via `nodeExpression` Argument
- Insecure deserialization
- CWE-20
=1.4.0 · no fixed version yet
GHSA-4m5h-5v4q-4xgq · CVE-2025-2622 - CVSS 5.4 Medium
Apache Oozie Cross-Site Scripting (XSS)
- Cross-site scripting (XSS)
<=5.2.1 · no fixed version yet
GHSA-fmxw-76xq-cmqq · CVE-2025-26796 - CVSS 5.1 Medium
Liferay Portal and Liferay DXP Reveals Data via Forms
- Information disclosure
>=2024.Q3.0, <2024.Q3.1 || >=2024.Q2.0, <=2024.Q2.12 || >=2024.Q1.1, <2024.Q1.13 || >=2023.Q4.0, <=2023.Q4.10 || >=2023.Q3.1, <=2023.Q3.10 · fixed in 2024.Q3.1, 2024.Q1.13
GHSA-9fcg-wrp8-qhr4 · CVE-2025-2565 - CVSS 5.8 Medium
Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect
- Cross-site scripting (XSS)
- Open redirect
<31.0.2 || >=32.0.0, <32.0.1 · fixed in 31.0.2, 32.0.1
GHSA-2xcr-p767-f3rv · CVE-2025-27888 - CVSS 8.2 High
H2O Vulnerable to Arbitrary File Overwrite
- Path traversal
>=3.10.4.1, <=3.46.0 · no fixed version yet
GHSA-g48v-3p35-88jr · CVE-2024-8616 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
- CWE-1088
>=3.2.0.1, <=3.46.0 · no fixed version yet
GHSA-5c8j-g96x-cj78 · CVE-2024-8062 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
- Denial of service
<=3.46.1 · no fixed version yet
GHSA-p2vc-m5fv-9w9m · CVE-2024-7768 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
- CWE-409
>=3.32.1.2, <=3.46.0.2 · no fixed version yet
GHSA-6w62-3jvj-mfj6 · CVE-2024-7765 - CVSS 6.5 Medium
H2O Vulnerable to Execution of Arbitrary Files
- CWE-749
>=3.32.1.2, <=3.46.0 · no fixed version yet
GHSA-m37h-8r48-2cxj · CVE-2024-6863 - CVSS 7.1 High
H2O Vulnerable to Arbitrary File Overwrite via File Export
- Path traversal
>=3.32.1.1, <=3.46.0 · no fixed version yet
GHSA-47f6-5p7h-5f3h · CVE-2024-6854 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
- Denial of service
>=3.30.0.7, <=3.46.0.1 · no fixed version yet
GHSA-wwr9-4gmr-xvq9 · CVE-2024-10549 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) and File Write
- Code injection
- Denial of service
>=3.34.0.1, <=3.46.0.1 · no fixed version yet
GHSA-wjpv-64v2-2qpq · CVE-2024-10572 - CVSS 9.8 CriticalCritical · CVSS 9+
H2O Deserialization of Untrusted Data Vulnerability
- Insecure deserialization
<3.46.0.6 · fixed in 3.46.0.6
GHSA-h7xg-cmpp-48hf · CVE-2024-10553 - CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
- Denial of service
>=3.30.0.7, <=3.46.0.1 · no fixed version yet
GHSA-7qq7-pvm9-x8rf · CVE-2024-10550 - CVSS 4.3 Medium
Apache Seata Vulnerable to Data Amplification
- CWE-409
>=2.0.0, <2.3.0 · fixed in 2.3.0
GHSA-65vg-64g8-mwjr · CVE-2024-54016 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Seata Vulnerable to Deserialization of Untrusted Data
- Insecure deserialization
>=2.0.0, <2.2.0 · fixed in 2.2.0
GHSA-2r4x-667f-mpfh · CVE-2024-47552 - CVSS 7.4 High
Spring Security Does Not Enforce Password Length
- Authentication bypass
- Hard-coded credentials
>=6.3.0, <6.3.8 || >=6.4.0, <6.4.4 || >=6.2.0, <6.2.10 || >=6.1.0, <6.1.14 || >=6.0.0, <6.0.16 || >=5.8.0, <5.8.18 || <5.7.16 · fixed in 6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16
GHSA-mg83-c7gq-rv5c · CVE-2025-22228 - CVSS 5.1 Medium
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
- Cross-site scripting (XSS)
>=2024.Q2.0, <=2024.Q2.11 || >=2024.Q1.1, <2024.Q1.13 || >=2023.Q4.0, <2024.Q4.0 || >=2023.Q3.1, <2024.Q4.0 || >=2024.Q3.0, <2024.Q3.1 · fixed in 2024.Q1.13, 2024.Q4.0, 2024.Q3.1
GHSA-hrc4-p2h3-pjqw · CVE-2025-2536 - CVSS 7.9 High
The WikiManager REST API allows any user to create wikis
- Broken access control
>=5.4-rc-1, <15.10.15 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0 · fixed in 15.10.15, 16.4.6, 16.10.0
GHSA-gfp2-6qhm-7x43 · CVE-2025-29926 - CVSS 8.7 High
XWiki allows unregistered users to access private pages information through REST endpoint
- CWE-402
>=1.9M1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1 · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1
GHSA-22q5-9phm-744v · CVE-2025-29925 - CVSS 8.7 High
XWiki uses the wrong wiki reference in AuthorizationManager
- Privilege escalation
- Broken access control
>=6.1-rc-1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1 · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1
GHSA-gq32-758c-3wm3 · CVE-2025-29924 - CVSS 8.0 High
Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability
- Cross-site scripting (XSS)
=1.0 · no fixed version yet
GHSA-xxrg-mg63-qfpj · CVE-2025-30196 - CVSS 3.1 Low
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
- Hard-coded credentials
- CWE-549
<1.0.31.v4a_b_1db_6d6a_f2 · fixed in 1.0.31.v4a_b_1db_6d6a_f2
GHSA-2x3g-rr4w-4qrp · CVE-2025-30197 - CVSS 5.8 Medium
Wire has Uncontrolled Recursion on Nested Groups
- Denial of service
<5.2.0 · fixed in 5.2.0
GHSA-pwf9-q62p-v7wc · CVE-2024-58103 - CVSS 3.3 Low
Snowflake JDBC Driver client-side encryption key in DEBUG logs
- Information disclosure
>=3.0.13, <3.23.1 · fixed in 3.23.1
GHSA-q298-375f-5q63 · CVE-2025-27496 - CVSS 4.3 Medium
Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check
- Weak cryptography or TLS
<=0.3.0 · no fixed version yet
GHSA-p53j-g8pw-4w5f · CVE-2020-36843 - CVSS 6.9 Medium
Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
- Information disclosure
>=1.13.0, <2.3.0 · fixed in 2.3.0
GHSA-35gq-cvrm-xf94 · CVE-2025-27017 - CVSS 5.6 Medium
Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin
- Cross-site scripting (XSS)
<1.2.2 · fixed in 1.2.2
GHSA-2cv6-4f2r-jq2c · CVE-2025-27867 - CVSS 7.5 High
SmallRye Fault Tolerance out-of-memory (OOM) issue
- CWE-1325
>=6.3.0, <6.4.2 || >=6.5.0, <6.9.0 · fixed in 6.4.2, 6.9.0
GHSA-gfh6-3pqw-x2j4 · CVE-2025-2240 - CVSS 4.2 Medium
Apache Camel Message Header Injection through request parameters
- CWE-164
>=3.10.0, <3.22.4 || >=4.9.0, <4.10.2 || >=4.0.0-M1, <4.8.5 · fixed in 3.22.4, 4.10.2, 4.8.5
GHSA-96v5-c2h5-56hm · CVE-2025-29891 - CVSS 5.4 Medium
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
- Broken access control
>=26.1.0, <26.1.3 || <26.0.10 · fixed in 26.1.3, 26.0.10
GHSA-gvgg-2r3r-53x7 · CVE-2025-1391 - CVSS 5.4 Medium
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
- Authentication bypass
>=26.1.0, <26.1.3 || <26.0.10 · fixed in 26.1.3, 26.0.10
GHSA-2p82-5wwr-43cw · CVE-2025-0604 - CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
- Insecure deserialization
- CWE-44
>=11.0.0-M1, <11.0.3 || >=10.1.0-M1, <10.1.35 || >=9.0.0.M1, <9.0.99 || >=8.5.0, <=8.5.100 · fixed in 11.0.3, 10.1.35, 9.0.99
GHSA-83qj-6fr2-vhqg · CVE-2025-24813 - CVSS 4.0, no score published
LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-47qw-ccjm-9c2c - CVSS 4.0, no score published
LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-v232-254c-m6p7 - CVSS 4.0, no score published
LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-2466-4485-4pxj - CVSS 5.5 Medium
LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-g6wm-2v64-wq36 · CVE-2025-27136 - CVSS 5.6 Medium
Apache Camel: Camel Message Header Injection via Improper Filtering
- CWE-178
>=3.10.0, <3.22.4 || >=4.0.0-M1, <4.8.5 || >=4.9.0, <4.10.2 · fixed in 3.22.4, 4.8.5, 4.10.2
GHSA-2c2h-2855-mf97 · CVE-2025-27636 - CVSS 7.5 High
com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public
- Information disclosure
<1.11.7 · fixed in 1.11.7
GHSA-3w9f-2pph-j5vc · CVE-2025-27604