Maven Advisories.

Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata

• Cross-site scripting (XSS)

<2.8.6 · fixed in 2.8.6

Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression

• Other injection
• Code injection

<1.8.5 · fixed in 1.8.5

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

• CWE-116

>=2.14.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3 · fixed in 2.25.4

Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

• CWE-116

>=2.7, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta2 · fixed in 2.25.4

Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

• Weak cryptography or TLS

>=2.12.0, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3 · fixed in 2.25.4

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

• Other injection
• CWE-684

>=2.21.0, <2.25.4 || >=3.0.0-beta1, <=3.0.0-beta3 · fixed in 2.25.4

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

• CWE-116

>=2.0-alpha1, <2.25.4 || >=3.0.0-alpha1, <=3.0.0-beta3 · fixed in 2.25.4

Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

• Denial of service

<5.19.4 || >=6.0.0, <6.2.4 · fixed in 5.19.4, 6.2.4

Spring Cloud Gateway's SSL bundle configuration silently bypassed

• CWE-15

>=4.2.0, <4.2.1 · fixed in 4.2.1

Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

• Information disclosure

>=9.0.13, <9.0.117 || >=10.1.0-M1, <10.1.54 || >=11.0.0-M1, <11.0.21 · fixed in 9.0.117, 10.1.54, 11.0.21

Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

• CWE-116

>=9.0.40, <9.0.116 || >=10.1.0-M1, <10.1.54 || >=11.0.0-M1, <11.0.21 · fixed in 9.0.116, 10.1.54, 11.0.21

Apache Tomcat Missing Encryption of Sensitive Data vulnerability

• Weak cryptography or TLS
• CWE-807

>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117 · fixed in 11.0.21, 10.1.54, 9.0.117

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

• Authentication bypass

>=9.0.92, <9.0.117 || >=10.1.22, <10.1.54 || >=11.0.0-M14, <11.0.21 · fixed in 9.0.117, 10.1.54, 11.0.21

Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

• Information disclosure
• CWE-642

>=9.0.13, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.0-M1, <11.0.20 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109 · fixed in 9.0.116, 10.1.53, 11.0.20

Apache Tomcat has an Open Redirect vulnerability

• Open redirect

>=8.5.30, <9.0.116 || >=10.1.0-M1, <10.1.53 || >=11.0.0-M1, <11.0.20 · fixed in 9.0.116, 10.1.53, 11.0.20

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

• Authentication bypass

>=9.0.83, <9.0.116 || >=10.1.0-M7, <10.1.53 || >=11.0.0-M1, <11.0.20 · fixed in 9.0.116, 10.1.53, 11.0.20

Apache Tomcat has an Improper Input Validation vulnerability

• CWE-20

>=9.0.113, <9.0.116 || >=10.1.50, <10.1.53 || >=11.0.15, <11.0.20 · fixed in 9.0.116, 10.1.53, 11.0.20

Apache Tomcat: Configured cipher preference order not preserved

• Weak cryptography or TLS

>=9.0.114, <9.0.116 || >=10.1.51, <10.1.53 || >=11.0.16, <11.0.20 · fixed in 9.0.116, 10.1.53, 11.0.20

Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

>=7.0.0, <9.0.116 || >=10.1.0-M1, <10.1.52 || >=11.0.0-M1, <11.0.20 · fixed in 9.0.116, 10.1.52, 11.0.20

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound

• Memory corruption

>=6.0.0, <6.2.4 · fixed in 6.2.4

Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

• CWE-598

>=3.1.3, <9.0.0 · fixed in 9.0.0

Apache OpenMeetings Uses Hard-coded Cryptographic Key

• Hard-coded credentials

>=6.1.0, <9.0.0 · fixed in 9.0.0

Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability

• CWE-274

>=3.10, <9.0.0 · fixed in 9.0.0

Apache DolphinScheduler vulnerable to sensitive information disclosure

• Information disclosure

>=3.1.0, <3.2.0 · fixed in 3.2.0

quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

• Path traversal

<2.16.0 · fixed in 2.16.0

Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

• CWE-226

>=12.1.0, <12.1.7 || >=12.0.0, <12.0.33 || >=11.0.0, <11.0.28 || >=10.0.0, <10.0.28 || >=9.4.0, <9.4.60 · fixed in 12.1.7, 12.0.33, 11.0.28, 10.0.28, 9.4.60

XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

• Broken access control

>=17.0.0-rc-1, <17.4.8 || >=17.5.0-rc-1, <17.10.1 · fixed in 17.4.8, 17.10.1

Emissary has a Path Traversal via Blacklist Bypass in Configuration API

• Path traversal

<8.39.0 · fixed in 8.39.0

Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

• Command injection

<8.39.0 · fixed in 8.39.0

Emissary has GitHub Actions Shell Injection via Workflow Inputs

• Command injection

<8.39.0 · fixed in 8.39.0

PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection

• Other injection
• Code injection

>=5.1.0, <=5.1.2 · no fixed version yet

PowerJob vulnerable to SQL injection

• Other injection
• SQL injection

>=5.1.0, <=5.1.2 · no fixed version yet

Emissary has Stored XSS via Navigation Template Link Injection

• Cross-site scripting (XSS)

<8.39.0 · fixed in 8.39.0

Java-SDK has a DNS Rebinding Vulnerability

• CWE-346

<1.0.0 · fixed in 1.0.0

Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

• Privilege escalation

>=5.0-alpha1, <5.0.7 · fixed in 5.0.7

Apache Cassandra has an authenticated DoS over CQL

• Denial of service

>=4.0, <4.0.20 || >=4.1, <4.1.11 || >=5.0, <5.0.7 · fixed in 4.0.20, 4.1.11, 5.0.7

Apache Cassandra has sensitive Information Leak in cqlsh

• Information disclosure

>=4.0, <4.0.20 · fixed in 4.0.20

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

• Insecure deserialization

<16.0.6 · fixed in 16.0.6

Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

• Race condition
• Memory corruption

>=2.8.0, <3.9.2 || >=4.0.0, <4.0.2 || >=4.1.0, <4.1.2 · fixed in 3.9.2, 4.0.2, 4.1.2

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

• Command injection
• Code injection

<5.19.5 || >=6.0.0, <6.2.3 · fixed in 5.19.5, 6.2.3

Apache ActiveMQ: Improper validation and restriction of a classpath path name

• Path traversal

<5.19.3 || >=6.0.0, <6.2.2 · fixed in 5.19.3, 6.2.2

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

• CWE-346

<26.4.13 || >=26.5.0, <26.6.3 · fixed in 26.4.13, 26.6.3

Jackson Core: Document length constraint bypass in blocking, async, and DataInput parsers

• Denial of service

>=3.0.0, <3.1.1 · fixed in 3.1.1

Keycloak: Replay of action tokens via improper handling of single-use entries

• CWE-653

<26.5.7 · fixed in 26.5.7

Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

• CWE-653

<26.5.7 · fixed in 26.5.7

Keycloak: Application-Level DoS via Scope Processing

• CWE-1050

<26.5.7 · fixed in 26.5.7

Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

• CWE-551

<26.5.7 · fixed in 26.5.7

Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

• Open redirect

<26.5.7 · fixed in 26.5.7

MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

• CWE-942

>=1.0.0, <1.0.1 || >=1.1.0, <1.1.1 || <0.18.3 · fixed in 1.0.1, 1.1.1, 0.18.3

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

• Hard-coded credentials
• Information disclosure

<6.9.4 · fixed in 6.9.4

FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

• Server-side request forgery (SSRF)

<6.9.4 · fixed in 6.9.4

HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect

• CWE-346

<6.9.4 · fixed in 6.9.4

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

• Information disclosure
• CWE-212

>=439, <480 · fixed in 480

AWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities

• CWE-20
• CWE-116

>=2.18.33, <2.41.30 · fixed in 2.41.30

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final · fixed in 2.2.40.Final, 2.3.25.Final

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final · fixed in 2.2.40.Final, 2.3.25.Final

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

>=2.3.0.Final, <2.3.25.Final || <2.2.40.Final · fixed in 2.3.25.Final, 2.2.40.Final

Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs

• Server-side request forgery (SSRF)

>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4

Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter

• SQL injection
• Other injection

>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4

Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters

• Other injection

>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4