Maven Advisories.

Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

• Privilege escalation

<1.0.18 · fixed in 1.0.18

Jenkins LDAP Plugin deserializes data from LDAP referrals without validation

• Insecure deserialization

<807.809.vd3a · fixed in 807.809.vd3a

Jenkins Active Directory Plugin follows LDAP referrals by default

• Server-side request forgery (SSRF)

<2.41.1 · fixed in 2.41.1

Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries

• Path traversal

<798.v5cc688825312 · fixed in 798.v5cc688825312

Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation

• Insecure deserialization

<2.41.1 · fixed in 2.41.1

Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem

• Path traversal

<1933.1935.v276319e3cc47 · fixed in 1933.1935.v276319e3cc47

Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials

• Path traversal
• CWE-20

<725.ve52b · fixed in 725.ve52b

Jenkins LDAP Plugin follows LDAP referrals

• Server-side request forgery (SSRF)

<807.809.vd3a · fixed in 807.809.vd3a

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

• CWE-1284

<26.6.3 · fixed in 26.6.3

Keycloak Services has Improper Validation of Consistency within Input

• CWE-1288

>=26.5.0, <=26.6.4 || <=26.4.7 · no fixed version yet

Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

• Code injection

<5.12.7 · fixed in 5.12.7

Yamcs has No Rate Limiting on Authentication Endpoint

• Authentication bypass

<5.12.7 · fixed in 5.12.7

Yamcs vulnerable to unauthorized user enumeration via IAM API endpoints

• Broken access control

<5.12.7 · fixed in 5.12.7

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

• Other injection

<5.12.7 · fixed in 5.12.7

netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

• Weak cryptography or TLS

<0.0.21.Final · fixed in 0.0.21.Final

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

• Information disclosure

>=6.2.1, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0-rc-1, <17.10.3 · fixed in 16.10.17, 17.4.9, 17.10.3

XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

• Path traversal

>=9.6-rc-1, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0-rc-1, <17.10.3 · fixed in 16.10.17, 17.4.9, 17.10.3

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

• Broken access control

>=15.10.6, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0, <17.10.3 || >=18.0.0-rc-1, <18.1.0-rc-1 · fixed in 16.10.17, 17.4.9, 17.10.3, 18.1.0-rc-1

XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

• Path traversal

>=4.2-milestone-2, <16.10.17 || >=17.0.0-rc-1, <17.4.9 || >=17.5.0, <17.10.3 || >=18.0.0-rc-1, <18.1.0-rc-1 · fixed in 16.10.17, 17.4.9, 17.10.3, 18.1.0-rc-1

Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery

• Open redirect
• Server-side request forgery (SSRF)

>=2.0.0-alpha-0, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2 · fixed in 2.2.0, 3.0.0-alpha-2

Apache Shiro has a session fixation vulnerability

• Authentication bypass

>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2 · fixed in 2.2.0, 3.0.0-alpha-2

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

• CWE-614

>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2 · fixed in 2.2.0, 3.0.0-alpha-2

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login

• Open redirect

>=2.0-alpha, <2.2.1 || >=3.0.0-alpha-0, <3.0.0-alpha-2 · fixed in 2.2.1, 3.0.0-alpha-2

TCC-TRANSACTION has an Improper Input Validation vulnerability

• Insecure deserialization
• CWE-20

<=2.1.0 · no fixed version yet

Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

• CWE-202

>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1 · fixed in 4.0.6, 4.1.1

Apache Syncope has an Improper Isolation or Compartmentalization vulnerability

• CWE-653

>=3.0.0-M0, <=3.0.16 || >=4.0.0-M0, <4.0.6 || >=4.1.0-M0, <4.1.1 · fixed in 4.0.6, 4.1.1

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk

• Path traversal

>=1.1.0, <1.1.7 · fixed in 1.1.7

jasypt-spring-boot Uses a One-Way Hash without a Salt

• CWE-759
• CWE-760

>=3.0.0, <=4.0.4 · no fixed version yet

Apache CXF has an LDAP injection vulnerability

• Other injection

>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11 · fixed in 4.2.1, 4.1.6, 3.6.11

Apache CXF's WS-Transfer module has an insecure XML parser configuration

• XML external entities (XXE)

>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11 · fixed in 4.2.1, 4.1.6, 3.6.11

Apache CXF: Untrusted JMS configuration can lead to RCE

• CWE-15
• CWE-20

>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11 · fixed in 4.2.1, 4.1.6, 3.6.11

OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users

• Information disclosure

<1.12.4 · fixed in 1.12.4

Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise

• Broken access control

<26.6.3 · fixed in 26.6.3

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

• CWE-129

<6.3.0 || >=7.0.0-alpha01, <7.0.0-alpha03 · fixed in 6.3.0, 7.0.0-alpha03

Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)

• Insecure deserialization

<7.0.7 · fixed in 7.0.7

ORAS Java: Path traversal in pullArtifact via attacker-controlled org.opencontainers.image.title annotation

• Path traversal

<0.6.2 · fixed in 0.6.2

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

• Information disclosure

>=2.3.1, <2.5.10 · fixed in 2.5.10

GlassFish's Administration Console is Vulnerable to RCE

• Code injection

<4.2.0 · fixed in 4.2.0

GlassFish's gadget handler is vulnerable to RCE

• Code injection

<4.2.0 · fixed in 4.2.0

Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering

• CWE-178
• CWE-791

>=3.18.0, <4.14.6 || >=4.15.0, <4.18.2 · fixed in 4.14.6, 4.18.2

Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

• Open redirect

<26.6.2 · fixed in 26.6.2

Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

• Information disclosure

>=24.0.0, <24.9.18 || >=24.10.0, <24.10.4 || >=25.0.0, <25.0.12 || >=25.1.0, <25.1.5 · fixed in 24.9.18, 24.10.4, 25.0.12, 25.1.5

Keycloak: Access token disclosure and implicit flow bypass via forged client data

• CWE-472

<26.6.2 · fixed in 26.6.2

Keycloak: Session fixation in OIDC login flow that can lead to account takeover

• Authentication bypass

<26.6.2 · fixed in 26.6.2

Keycloak: Denial of Service via specially crafted SAML input

• CWE-1286

<26.6.2 · fixed in 26.6.2

Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers

• Broken access control

<26.6.2 · fixed in 26.6.2

Keycloak: Unauthorized account takeover via WebAuthn token replay

• Authentication bypass

<26.6.2 · fixed in 26.6.2

Keycloak Account Resources user lookup contains broken access control

• CWE-1220

<26.4.12 || >=26.5.0, <26.6.2 · fixed in 26.4.12, 26.6.2

Keycloak: Information Disclosure via evaluate-scopes Admin API

• Broken access control

<26.6.2 · fixed in 26.6.2

Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

• Broken access control

<26.6.2 · fixed in 26.6.2

Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured

• Authentication bypass

<=26.6.2 · no fixed version yet

Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

• CWE-603

<26.6.3 · fixed in 26.6.3

HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

• Denial of service

<6.9.7 · fixed in 6.9.7

async-http-client: Cookie header not stripped on cross-origin redirect

• Information disclosure

>=3.0.0.Beta1, <3.0.10 || >=2.0.0, <2.15.0 · fixed in 3.0.10, 2.15.0

Spring AI MCP Security: Unvalidated URL Fetching (SSRF)

• Server-side request forgery (SSRF)

<0.1.9 · fixed in 0.1.9

org.linlinjava:litemall-wx-api has an Injection issue

• Other injection
• SQL injection

<=0.1.0 · no fixed version yet

Beetl's SpELFunction extension function has an expression injection risk

• Code injection
• CWE-20

<=3.20.2.RELEASE · no fixed version yet

Improper Verification of Cryptographic Signature in com.oviva.telematik:epa4all-client

• Weak cryptography or TLS

<1.2.2 · fixed in 1.2.2

Apache Flink: Remote code execution via SQL injection in code generation

• Code injection

>=1.15.0, <1.20.4 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.2 || >=2.2.0, <2.2.1 · fixed in 1.20.4, 2.0.2, 2.1.2, 2.2.1

epa4all-client: TLS Certificate Validation Disabled in Production

• Weak cryptography or TLS

<1.2.2 · fixed in 1.2.2