Advisories · Java · Kotlin
Maven Advisories.
Every Maven Advisory we hold, newest first.
- CVSS 8.2 High
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
- Denial of service
<1.75.0 · fixed in 1.75.0
GHSA-prj3-ccx8-p6x4 · CVE-2025-55163 - CVSS 7.5 High
Apache Tomcat Improper Resource Shutdown or Release vulnerability
- Denial of service
>=11.0.0-M1, <11.0.10 || >=10.1.0-M1, <10.1.44 || >=9.0.0.M1, <9.0.108 · fixed in 11.0.10, 10.1.44, 9.0.108
GHSA-gqp3-2cvr-x8m3 · CVE-2025-48989 - CVSS 6.5 Medium
Apache Tomcat Session Fixation vulnerability
- Authentication bypass
>=11.0.0-M1, <11.0.8 || >=10.1.0-M1, <10.1.42 || >=9.0.0.M1, <9.0.106 · fixed in 11.0.8, 10.1.42, 9.0.106
GHSA-23hv-mwm6-g8jf · CVE-2025-55668 - CVSS 6.3 Medium
Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation
- Denial of service
>=1.0.0, <1.0.8 || >=2.0.0, <2.0.8 · fixed in 1.0.8, 2.0.8
GHSA-4cx2-fc23-5wg6 · CVE-2025-8916 - CVSS 5.1 Medium
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
- Cross-site scripting (XSS)
<15.2.2 · fixed in 15.2.2
GHSA-m5c7-5gv3-hcpf · CVE-2025-43734 - CVSS 6.9 Medium
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
- Cross-site scripting (XSS)
>=7.0.4, <109.1.0 · fixed in 109.1.0
GHSA-222w-xmc5-jhp3 · CVE-2025-43735 - CVSS 6.9 Medium
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
- Denial of service
<2.0.138 · fixed in 2.0.138
GHSA-cg99-m88x-422c · CVE-2025-43736 - CVSS 6.3 Medium
Bouncy Castle for Java on All (API modules) allows Excessive Allocation
- Denial of service
>=1.0.0, <1.0.2.6 || >=2.0.0, <2.0.1 · fixed in 1.0.2.6, 2.0.1
GHSA-67mf-3cr5-8w23 · CVE-2025-8885 - CVSS 5.1 Medium
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=2025.Q1.0, <2025.Q1.6 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92 · fixed in 2025.Q1.6, 2024.Q1.16
GHSA-c6g5-g6r7-q4j6 · CVE-2025-4655 - CVSS 5.3 Medium
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=2025.Q1.0, <2025.Q1.5 || >=2024.Q4.0, <=2024.Q4.7 || >=2024.Q3.1, <=2024.Q3.13 || >=2024.Q2.0, <=2024.Q2.13 || >=2024.Q1.0, <2024.Q1.16 || <=7.4.13.u92 · fixed in 2025.Q1.5, 2024.Q1.16
GHSA-6v93-frf9-2rp8 · CVE-2025-4581 - CVSS 6.9 Medium
Liferay Portal Reflected XSS in blogs-web
- Cross-site scripting (XSS)
<6.0.139 · fixed in 6.0.139
GHSA-6qcg-28jh-hm7r · CVE-2025-4576 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache CXF: Untrusted JMS configuration can lead to RCE
- CWE-20
<3.6.8 || >=4.0.0, <4.0.9 || >=4.1.0, <4.1.3 · fixed in 3.6.8, 4.0.9, 4.1.3
GHSA-g4px-6qhm-hqjm · CVE-2025-48913 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Seata: Deserialization of untrusted Data in Apache Seata Server
- Insecure deserialization
>=2.4.0, <2.5.0 · fixed in 2.5.0
GHSA-g358-g2pq-c46j · CVE-2025-53606 - CVSS 9.8 CriticalCritical · CVSS 9+
ExecuTorch vulnerable to Heap-based Buffer Overflow
- Memory corruption
<0.7.0 · fixed in 0.7.0
GHSA-xc7w-r669-48pf · CVE-2025-54951 - CVSS 9.8 CriticalCritical · CVSS 9+
ExecuTorch integer overflow vulnerability
- Memory corruption
<0.7.0 · fixed in 0.7.0
GHSA-hj95-mhgf-jxc4 · CVE-2025-30404 - CVSS 9.8 CriticalCritical · CVSS 9+
ExecuTorch out-of-bounds access vulnerability
- Memory corruption
<0.7.0 · fixed in 0.7.0
GHSA-f9hx-c6jf-3qxm · CVE-2025-54950 - CVSS 9.8 CriticalCritical · CVSS 9+
ExecuTorch heap buffer overflow vulnerability
- Memory corruption
<0.7.0 · fixed in 0.7.0
GHSA-9m39-3mf3-xwch · CVE-2025-54949 - CVSS 9.8 CriticalCritical · CVSS 9+
ExecuTorch integer overflow vulnerability
- Memory corruption
<0.7.0 · fixed in 0.7.0
GHSA-84m3-f99p-cqx5 · CVE-2025-30405 - CVSS 6.5 Medium
Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability
- Other injection
<=26.3.2 · no fixed version yet
GHSA-qj5r-2r5p-phc7 - CVSS 8.7 High
XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
- Information disclosure
>=1.1, <16.4.7 || >=16.5.0-rc-1, <16.10.5 || >=17.0.0-rc-1, <17.2.0-rc-1 · fixed in 16.4.7, 16.10.5, 17.2.0-rc-1
GHSA-57q2-6cp4-9mq3 · CVE-2025-54125 - CVSS 7.1 High
XWiki leaks password hashes and other accessible password properties
- Information disclosure
>=9.8-rc-1, <16.4.7 || >=16.5.0-rc-1, <16.10.5 || >=17.0.0-rc-1, <17.2.0-rc-1 · fixed in 16.4.7, 16.10.5, 17.2.0-rc-1
GHSA-r38m-cgpg-qj69 · CVE-2025-54124 - CVSS 6.5 Medium
XWiki allows Reflected XSS in two templates
- Cross-site scripting (XSS)
>=4.2-milestone-3, <16.4.8 || >=16.5.0-rc-1, <16.10.6 || >=17.0.0-rc-1, <17.3.0-rc-1 · fixed in 16.4.8, 16.10.6, 17.3.0-rc-1
GHSA-m9x4-w7p9-mxhx · CVE-2025-32430 - CVSS 6.9 Medium
Liferay Portal CAPTCHA Bypass for Gogo Shell
- Cross-site scripting (XSS)
<4.0.17 · fixed in 4.0.17
GHSA-3j6h-5v68-hvqg · CVE-2025-4604 - CVSS 7.5 High
Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability
- CWE-1385
>=0.11.1, <0.12.0 · fixed in 0.12.0
GHSA-xg8j-j6vp-6h5w · CVE-2024-51775 - CVSS 6.1 Medium
Apache Zeppelin: XSS in the Helium module
- Cross-site scripting (XSS)
<0.12.0 · fixed in 0.12.0
GHSA-p288-459w-jxj6 · CVE-2024-41177 - CVSS 7.5 High
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
- CWE-20
>=0.11.1, <0.12.0 · fixed in 0.12.0
GHSA-jr43-q92q-5q82 · CVE-2024-52279 - CVSS 5.7 Medium
OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object
- Information disclosure
<2.19.3.0 · fixed in 2.19.3.0
GHSA-2rjv-cv85-xhgm - CVSS 5.7 Medium
OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape
- Information disclosure
<2.19.3.0 · fixed in 2.19.3.0
GHSA-rrmm-wq7q-h4v5 - CVSS 7.5 High
Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering
- Cross-site scripting (XSS)
<2.12.3 · fixed in 2.12.3
GHSA-rrff-chj9-w4c7 · CVE-2025-24853 - CVSS 6.1 Medium
Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin
- Cross-site scripting (XSS)
<2.12.3 · fixed in 2.12.3
GHSA-72ww-4rcw-mc62 · CVE-2025-24854 - CVSS 6.5 Medium
Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability
- Other injection
<=1.3.10 · no fixed version yet
GHSA-cx25-xg7c-xfm5 · CVE-2025-54656 - CVSS 6.5 Medium
Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)
- Privilege escalation
>=26.2.0, <26.2.6 · fixed in 26.2.6
GHSA-27gp-8389-hm4w · CVE-2025-7784 - CVSS 7.1 High
Keycloak phishing attack via email verification step in first login flow
- CWE-346
<26.0.13 || >=26.2.0, <26.2.6 · fixed in 26.0.13, 26.2.6
GHSA-xhpr-465j-7p9q · CVE-2025-7365 - CVSS 6.5 Medium
Opencast still publishes global system account credentials
- Information disclosure
- Hard-coded credentials
<17.6 · fixed in 17.6
GHSA-j63h-hmgw-x4j7 · CVE-2025-54380 - CVSS 8.6 High
XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API
- SQL injection
- CWE-20
>=1.0, <16.10.6 || >=17.0.0-rc1, <17.3.0-rc-1 · fixed in 16.10.6, 17.3.0-rc-1
GHSA-p9qm-p942-q3w5 · CVE-2025-54385 - CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
- SQL injection
>=9.4-rc-1, <16.10.6 || >=17.0.0-rc-1, <17.3.0-rc-1 · fixed in 16.10.6, 17.3.0-rc-1
GHSA-vr59-gm53-v7cq · CVE-2025-32429 - CVSS 6.0 Medium
Jakarta Mail vulnerable to SMTP Injection
- CWE-147
<1.6.8 || >=2.0.0, <2.0.2 · fixed in 1.6.8, 2.0.2
GHSA-9342-92gg-6v29 · CVE-2025-7962 - CVSS 7.2 High
Apache Jena doesn't validate file access paths in configuration files uploaded by users with administrator access
- CWE-20
<5.5.0 · fixed in 5.5.0
GHSA-xg9p-p463-3qjp · CVE-2025-50151 - CVSS 4.9 Medium
Apache Jena allows users with administrator access to create databases files outside the files area of the Fuseki server
- Path traversal
<5.5.0 · fixed in 5.5.0
GHSA-jq2c-m8gg-mqcm · CVE-2025-49656 - CVSS 6.3 Medium
xxl-job has Inadequate Encryption Strength
- Weak cryptography or TLS
<3.2.0 · fixed in 3.2.0
GHSA-565h-44m8-4c2v · CVE-2025-7789 - CVSS 5.3 Medium
XXL-JOB is vulnerable to SSRF attacks
- Server-side request forgery (SSRF)
<=3.1.1 · no fixed version yet
GHSA-f8vw-8vgh-22r9 · CVE-2025-7787 - CVSS 6.5 Medium
Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)
- Privilege escalation
<=26.3.1 · no fixed version yet
GHSA-83j7-mhw9-388w - CVSS 8.9 High
Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
- Server-side request forgery (SSRF)
<=6.2.5 · no fixed version yet
GHSA-f7h5-c625-3795 · CVE-2024-9408 - CVSS 4.5 Medium
Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console
- Cross-site scripting (XSS)
<=7.0.25 · no fixed version yet
GHSA-vqrm-83g6-pfv4 · CVE-2024-10029 - CVSS 6.1 Medium
Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
- Cross-site scripting (XSS)
<=7.0.25 · no fixed version yet
GHSA-mqxx-c43h-jj9v · CVE-2024-9343 - CVSS 5.8 Medium
Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications
- Cross-site scripting (XSS)
<=7.0.25 · no fixed version yet
GHSA-hp97-5x6g-q538 · CVE-2024-10031 - CVSS 6.3 Medium
Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
- Authentication bypass
<=7.0.25 · no fixed version yet
GHSA-99f7-hp6j-v6q4 · CVE-2024-9342 - CVSS 6.1 Medium
Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
- Cross-site scripting (XSS)
<=7.0.25 · no fixed version yet
GHSA-62g9-99m7-w8wv · CVE-2024-10032 - CVSS 6.1 Medium
Reactor Netty HTTP is vulnerable to credential leaks during chained redirects
- Information disclosure
>=1.3.0-M1, <1.3.0-M5 || <1.2.8 · fixed in 1.3.0-M5, 1.2.8
GHSA-4q2v-9p7v-3v22 · CVE-2025-22227 - CVSS 5.2 Medium
DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format
- Path traversal
<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1 · fixed in 7.6.4, 8.2, 9.1
GHSA-vhvx-8xgc-99wf · CVE-2025-53622 - CVSS 6.9 Medium
DSpace is vulnerable to XML External Entity injection during archive imports
- XML external entities (XXE)
<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1 · fixed in 7.6.4, 8.2, 9.1
GHSA-jjwr-5cfh-7xwh · CVE-2025-53621 - CVSS 5.6 Medium
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged
- Denial of service
<3.5.11 || >=3.6.0, <3.6.6 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.1 · fixed in 3.5.11, 3.6.6, 4.0.7, 4.1.1
GHSA-36wv-v2qp-v4g4 · CVE-2025-48795 - CVSS 10.0 CriticalCritical · CVSS 9+
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
- Code injection
- Broken access control
>=4.2-milestone-1, <13.10.11 || >=14.0, <14.4.7 || >=14.5, <14.10 · fixed in 13.10.11, 14.4.7, 14.10
GHSA-32mf-57h2-64x9 · CVE-2025-53836 - CVSS 9.1 CriticalCritical · CVSS 9+
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
- Cross-site scripting (XSS)
>=5.4.5, <14.10 · fixed in 14.10
GHSA-w3wh-g4m9-783p · CVE-2025-53835 - CVSS 8.8 High
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
- XML external entities (XXE)
>=2.23.0-beta, <2.23.2-beta || >=2.20.0, <2.20.17 || >=2.22.0, <2.22.1 · fixed in 2.23.2-beta, 2.20.17, 2.22.1
GHSA-44c3-38h8-9fh9 · CVE-2025-53689 - CVSS 7.5 High
Apache Zeppelin exposes server resources to unauthenticated attackers
- CWE-664
>=0.10.1, <0.12.0 · fixed in 0.12.0
GHSA-7pgf-ppxw-8624 · CVE-2024-41169 - CVSS 8.1 High
ExecuTorch vulnerable to Heap-based Buffer Overflow attack
- Memory corruption
<0.7.0-rc1 · fixed in 0.7.0-rc1
GHSA-h952-963h-rv99 · CVE-2025-30402 - CVSS 6.5 Medium
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
- Denial of service
>=2.0, <=2.6 · no fixed version yet
GHSA-j288-q9x7-2f5v · CVE-2025-48924 - CVSS 5.8 Medium
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
- Denial of service
>=9.38-rc1, <10.0.2 || <9.37.4 · fixed in 10.0.2, 9.37.4
GHSA-xwmg-2g98-w7v9 · CVE-2025-53864 - CVSS 7.5 High
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
- Denial of service
>=8.5.0, <=8.5.100 || >=9.0.0.M1, <9.0.107 || >=10.1.0-M1, <10.1.43 || >=11.0.0-M1, <11.0.9 · fixed in 9.0.107, 10.1.43, 11.0.9
GHSA-25xr-qj8w-c4vf · CVE-2025-53506