Maven Advisories.

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

• Denial of service

>=42.2.0, <42.7.11 · fixed in 42.7.11

Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

• Server-side request forgery (SSRF)

<2.9.3 · fixed in 2.9.3

XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter

• Server-side request forgery (SSRF)

<2.4.1 · fixed in 2.4.1

Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

• Server-side request forgery (SSRF)

<2.0.0-milestone-10 · fixed in 2.0.0-milestone-10

Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

• Path traversal

<2.0.0-milestone-10 · fixed in 2.0.0-milestone-10

Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

• Other injection
• HTTP request smuggling

<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final · fixed in 4.1.133.Final, 4.2.13.Final

Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

• Weak cryptography or TLS

<0.23.0 · fixed in 0.23.0

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

• Information disclosure

<2.16.0-lts || >=2.16.0, <2.17.0 · fixed in 2.16.0-lts, 2.17.0

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

• Code injection

<3.1.5.RELEASE · fixed in 3.1.5.RELEASE

OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange

• Code injection

>=2.7.0, <2.7.9 || >=2.8.0, <2.8.6 · fixed in 2.7.9, 2.8.6

Apache Polaris has an Improper Input Validation issue

• Broken access control
• CWE-20

>=0.9.0, <1.4.1 · fixed in 1.4.1

Apache Polaris has an Improper Input Validation Issue

• CWE-20
• CWE-116

<1.4.1 · fixed in 1.4.1

Apache Polaris has an Improper Input Validation issue

• Code injection
• CWE-20

<1.4.1 · fixed in 1.4.1

Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest

• Code injection
• Insecure deserialization

>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5 · fixed in 2.5.9, 3.0.0-M3, 1.9.5

Apache Polaris has an Improper Input Validation Issue

• Broken access control
• CWE-20

<1.4.1 · fixed in 1.4.1

Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation

• Denial of service

>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5 · fixed in 2.5.9, 3.0.0-M3, 1.9.5

Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

• XML external entities (XXE)

>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5 · fixed in 2.5.9, 3.0.0-M3, 1.9.5

Apache Atlas has a Code Injection Vulnerability

• Code injection

>=0.8, <2.5.0 · fixed in 2.5.0

OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip)

• Path traversal

<=2.7.8 || >=2.8.0, <=2.8.5 · no fixed version yet

Quarkus has Authentication/Authorization bypasses

• Authentication bypass
• Broken access control

<3.20.6.1 || >=3.21.0, <3.27.3.1 || >=3.30.0, <3.33.1.1 || >=3.34.0, <3.35.1.1 · fixed in 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1

OpenMRS ModuleResourcesServlet has Path Traversal that Leads to Arbitrary File Read

• Path traversal

<=2.7.8 || >=2.8.0, <2.8.6 · fixed in 2.8.6

jOpenDocument has an improper restriction of XML external entity reference vulnerability

• XML external entities (XXE)

<=1.3 · no fixed version yet

Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix)

• Insecure deserialization

>=2.1.0, <2.1.12 || >=2.2.0, <2.2.7 · fixed in 2.1.12, 2.2.7

Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix)

• Insecure deserialization

>=2.1.0, <2.1.12 || >=2.2.0, <2.2.7 · fixed in 2.1.12, 2.2.7

Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API

• Server-side request forgery (SSRF)

<3.2.2 · fixed in 3.2.2

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization

• Denial of service

<3.2.2 · fixed in 3.2.2

Apache Neethi does not properly detect circular references in policy definitions.

• Denial of service

<3.2.2 · fixed in 3.2.2

Shopizer is vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<=2.16.0 · no fixed version yet

Shopizer has a path traversal issue

• Path traversal

<=2.16.0 · no fixed version yet

Keycloak has a Forced Browsing issue

• Broken access control

<=26.6.1 · no fixed version yet

appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution

• SQL injection

<1.99 · fixed in 1.99

fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE

• Insecure deserialization

>=1.0.0, <=2.2.26 · no fixed version yet

Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability

• Open redirect

<667.v4c5827a · fixed in 667.v4c5827a

Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file

• Cross-site scripting (XSS)

<427.1 · fixed in 427.1

Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

• Broken access control

<1967.1969.v205fd594c821 · fixed in 1967.1969.v205fd594c821

Jenkins GitHub Plugin has an XSS vulnerability

• Cross-site scripting (XSS)

<1.46.0.1 · fixed in 1.46.0.1

Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

• Broken access control

<1402.v94c9ce464861 · fixed in 1402.v94c9ce464861

Jenkins Credentials Binding Plugin has a path traversal vulnerability

• Path traversal

<720.v3f6decef43ea · fixed in 720.v3f6decef43ea

Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors

• Insecure deserialization

>=2.0-beta-1, <3.2.10 · fixed in 3.2.10

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

• CWE-524

>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47 · fixed in 7.0.7, 6.2.18

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

• Denial of service

>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47 · fixed in 7.0.7, 6.2.18

Spring Framework DoS with Multipart Temp Files in WebFlux

• Denial of service

>=7.0.0, <7.0.7 || >=6.2.0, <6.2.18 || >=6.1.0, <=6.1.26 || <=5.3.47 · fixed in 7.0.7, 6.2.18

xxl-job has a Resource Injection issue

• CWE-99

<3.4.0 · fixed in 3.4.0

Spring gRPC SecurityContext leaks across requests upon authorization failure

• CWE-653

<1.0.3 · fixed in 1.0.3

Spring gRPC AuthenticationException messages are reflected to remote client

• Information disclosure

<1.0.3 · fixed in 1.0.3

Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

• Weak cryptography or TLS

<0.23.0 · fixed in 0.23.0

Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

• Broken access control

>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5 · fixed in 1.0.6, 1.1.5

Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

• CWE-377

>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5 · fixed in 1.0.6, 1.1.5

Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

• SQL injection

>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5 · fixed in 1.0.6, 1.1.5

Spring AI Vulnerable to OOM by attacker-controlled PDF

• Denial of service

>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5 · fixed in 1.0.6, 1.1.5

Spring AI has a VectorStore FilterExpression Converter injection

• Code injection

>=1.0.0, <1.0.6 || >=1.1.0, <1.1.5 · fixed in 1.0.6, 1.1.5

Spring Boot accepts predictable temp directory without ownership verification

• CWE-377

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

• Broken access control
• CWE-305

>=4.0.0, <4.0.6 · fixed in 4.0.6

Spring Boot's PID file write follows symlinks at predictable default path

• Path traversal

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

• Weak cryptography or TLS

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 · fixed in 4.0.6, 3.5.14

Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

• CWE-208

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.14 || >=3.4.0, <=3.4.15 || >=3.3.0, <=3.3.18 || <=2.7.32 · fixed in 4.0.6, 3.5.14

Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.

• Weak cryptography or TLS

>=4.0.0, <4.0.6 · fixed in 4.0.6

Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment

• Authentication bypass

<2.8.7 · fixed in 2.8.7