Maven Advisories.

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

• Broken access control
• Server-side request forgery (SSRF)

>=1.1.0, <3.0.4 · fixed in 3.0.4

Armeria: External Control of File Name or Path in xDS SDS DataSource

• Path traversal

<1.40.0 · fixed in 1.40.0

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

• Broken access control

<3.0.3 · fixed in 3.0.3

JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

• Denial of service

>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14 · fixed in 4.2.1, 4.0.16, 3.30.14

JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

• Denial of service

>=4.1.0, <4.2.1 || >=4.0.0, <4.0.16 || <3.30.14 · fixed in 4.2.1, 4.0.16, 3.30.14

Karate Mock Server RCE via embedded expression evaluation of request-derived data

• Code injection

>=2.0.1, <2.1.0 · fixed in 2.1.0

Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

• Privilege escalation
• CWE-272

<1.0.1 · fixed in 1.0.1

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

• Privilege escalation
• CWE-441

<1.0.1 · fixed in 1.0.1

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

• XML external entities (XXE)

<6.9.10 · fixed in 6.9.10

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

• Denial of service

<6.9.10 · fixed in 6.9.10

handlebars.java FileTemplateLoader Path Traversal

• Path traversal

<4.5.2 · fixed in 4.5.2

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

• SQL injection

<1.2.1-beta8 || >=1.3.0-beta9, <1.5.1-beta11 || >=1.6.0-beta12, <1.11.8-beta19 || >=1.12.1-beta21, <1.16.3-beta26 · fixed in 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, 1.16.3-beta26

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

• Other injection

<2.2.1 || >=3.0.0-alpha-0, <3.0.0-alpha-2 · fixed in 2.2.1, 3.0.0-alpha-2

Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

• Information disclosure

<3.4.2 · fixed in 3.4.2

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

• Broken access control

<3.4.2 · fixed in 3.4.2

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

• Broken access control

<3.4.2 · fixed in 3.4.2

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

• Broken access control

<3.4.2 · fixed in 3.4.2

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

• Broken access control

<3.4.2 · fixed in 3.4.2

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

• Other injection

>=1.0.0, <1.0.9 || >=1.1.0, <1.1.8 · fixed in 1.0.9, 1.1.8

SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

• Path traversal
• Broken access control

<=3.8.3 · no fixed version yet

Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

• Denial of service

>=3.1.0, <=3.1.11 · no fixed version yet

Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

• HTTP request smuggling

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: Wrapping plain trust manager silently disables hostname verification

• Weak cryptography or TLS

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

• Information disclosure
• Weak cryptography or TLS

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

• Denial of service

>=4.2.0.Final, <4.2.15.Final · fixed in 4.2.15.Final

ConnectBot SSH Client Library: Excessive allocation and integer overflow in DER private-key parsing

• Memory corruption
• Denial of service

<=0.3.0 · no fixed version yet

ConnectBot SSH Client Library: Unbounded SSH field lengths can cause excessive memory allocation

• Denial of service
• CWE-20

<=0.3.0 · no fixed version yet

Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation

• CWE-346
• CWE-807

<2.0 · fixed in 2.0

Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators

• Race condition

<1.99 · fixed in 1.99

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

• XML external entities (XXE)
• Server-side request forgery (SSRF)

<2.26.4 || >=2.27.0, <2.27.3 · fixed in 2.26.4, 2.27.3

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

• Path traversal

>=2.27.0, <2.27.3 || <2.26.4 · fixed in 2.27.3, 2.26.4

Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

• Insecure deserialization
• CWE-20

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache cxf-core: No restriction on attachment headers per message

• Denial of service

>=4.2.0, <4.2.2 || >=4.0.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

• Insecure deserialization
• CWE-20

>=4.2.0, <4.2.2 || >=4.1.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

• Weak cryptography or TLS

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF has Improper Restriction of XML External Entity Reference

• XML external entities (XXE)

>=4.2.0, <4.2.2 || >=4.0.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection

• Other injection

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

• CWE-20
• CWE-358

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

• Other injection

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

• Authentication bypass
• CWE-289

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

• Race condition

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService

• Authentication bypass

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

• Other injection
• Insecure deserialization

<2.27.0 · fixed in 2.27.0

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

• Denial of service
• CWE-1286

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks

• Broken access control

<26.7.0 · fixed in 26.7.0

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

• Denial of service

<4.1.135.Final || >=4.2.0.Alpha1, <4.2.15.Final · fixed in 4.1.135.Final, 4.2.15.Final

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

• Memory corruption

<0.0.22.Final · fixed in 0.0.22.Final

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

• Denial of service

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

• Server-side request forgery (SSRF)

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring for GraphQL: Unsafe Deserialization

• Insecure deserialization

>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 · fixed in 2.0.4, 1.4.6

Spring for GraphQL: Annotation Detection Vulnerability

• Broken access control

>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 || >=1.0.0, <=1.0.6 · fixed in 2.0.4, 1.4.6

Spring Web Services: Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

• Weak cryptography or TLS

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring for GraphQL: Cross-Site WebSocket Hijacking

• CWE-346

>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 || >=1.0.0, <=1.0.6 · fixed in 2.0.4, 1.4.6

Spring Boot: Predictable Temp Directory in Artemis Auto-configuration

• CWE-377

>=4.0.0, <4.0.7 || >=3.5.0, <3.5.15 || >=3.4.0, <=3.4.16 || >=3.3.0, <=3.3.19 || >=2.7.0, <=2.7.33 · fixed in 4.0.7, 3.5.15

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

• CWE-1188

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring Web Services: WSS4J validation does not use configured replay cache

• Authentication bypass

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring Web Services: X.509 authentication bypasses Spring Security account checks

• Authentication bypass

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring Web Services: SOAP security faults leak Spring Security account state

• Information disclosure

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4