Maven Advisories.

Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

• Insecure deserialization

>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

• Insecure deserialization

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.20.0 · fixed in 4.14.8, 4.18.3, 4.20.0

LaunchServer FileServerHandler has an unauthenticated path traversal issue

• Path traversal
• Information disclosure

<=5.7.11 · no fixed version yet

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

• CWE-1287

<=26.2.5 || >=26.3.0, <=26.4.7 || >=26.5.0, <26.5.5 · fixed in 26.5.5

OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

• CWE-636
• CWE-757

<3.3 · fixed in 3.3

Keycloak has privilege escalation via improper scope mapping enforcement

• Privilege escalation

<26.6.4 · fixed in 26.6.4

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

• Path traversal

<0.6.4 · fixed in 0.6.4

CrateDB's Blob HTTP handler bypasses authorization

• Broken access control

<6.2.8 || >=6.3.0, <6.3.2 · fixed in 6.2.8, 6.3.2

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

• Denial of service

<5.4.3 || >=5.5-alpha1, <5.5-beta2 · fixed in 5.4.3, 5.5-beta2

Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

• Denial of service

<5.4.3 || >=5.5-alpha1, <5.5-beta2 · fixed in 5.4.3, 5.5-beta2

GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field

• Broken access control

>=4.0.0-alpha.1, <=4.0.6-0 || >=4.2.0, <4.2.16 || >=4.4.0, <4.4.11 · fixed in 4.2.16, 4.4.11

GeoNetwork has reflected XSS through client-side template injection

• Cross-site scripting (XSS)
• Code injection

>=3.0.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.15 || >=4.4.0, <4.4.10 · fixed in 4.2.15, 4.4.10

Sigstore Java has a vulnerability with bundle verification of integratedTime

• Weak cryptography or TLS

>=2.0.0, <2.1.0 · fixed in 2.1.0

Apache Gravitino JDBC configuration validation bypass can allow file reads or truncation

• SQL injection

>=0.5.0, <1.0.0 · fixed in 1.0.0

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability

• CWE-20
• CWE-839

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability

• Broken access control

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability

• CWE-20

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ Improper Authorization vulnerability

• Broken access control

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability

• Denial of service

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability

• Denial of service

>=5.19.7, <5.19.8 || >=6.2.6, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability

• Denial of service

<5.19.8 || >=6.0.0, <6.2.7 · fixed in 5.19.8, 6.2.7

Apache Tomcat has a Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 || <=7.0.109 · fixed in 11.0.23, 10.1.56, 9.0.119

Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability

• CWE-670

>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 · fixed in 11.0.23, 10.1.56, 9.0.119

Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability

• CWE-670

>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 · fixed in 11.0.23, 10.1.56, 9.0.119

Apache Tomcat has an Improper Authentication vulnerability

• Authentication bypass

>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.13, <9.0.119 || >=8.5.38, <=8.5.100 || >=7.0.100, <=7.0.109 · fixed in 11.0.23, 10.1.56, 9.0.119

Apache Tomcat has a Missing Critical Step in Authentication vulnerability

• Authentication bypass

>=11.0.0-M1, <11.0.5 || >=10.1.0-M1, <10.1.37 || >=9.0.0.M1, <9.0.101 || >=8.5.0, <=8.5.100 || <=7.0.109 · fixed in 11.0.5, 10.1.37, 9.0.101

Apache Tomcat has an Improper Authorization vulnerability

• Broken access control

>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100 || <=7.0.109 · fixed in 11.0.23, 10.1.56, 9.0.119

Apache Tomcat util accepted misconfigured CRLs

• CWE-390

>=11.0.0-M1, <11.0.23 || >=10.1.0-M7, <10.1.56 || >=9.0.83, <9.0.119 · fixed in 11.0.23, 10.1.56, 9.0.119

OpenAM OAuth Authorization Bypass via PKCE Challenge

• Broken access control

<16.1.1 · fixed in 16.1.1

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

• Authentication bypass

<16.1.1 · fixed in 16.1.1

OpenAM Authenticated RCE via Groovy Sandbox Escape

• CWE-693

<16.1.1 · fixed in 16.1.1

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

• Hard-coded credentials
• CWE-620

<16.1.1 · fixed in 16.1.1

OpenAM Authentication Bypass via MSISDN LDAP Injection

• Other injection
• CWE-1188

<16.1.1 · fixed in 16.1.1

Apache IoTDB has a Path Traversal vulnerability

• Path traversal

>=2.0.0, <2.0.6 || >=1.0.0, <1.3.6 · fixed in 2.0.6, 1.3.6

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

• Insecure deserialization

<2.4.20-Beta1 · fixed in 2.4.20-Beta1

Apache IoTDB has a Path Traversal vulnerability

• Path traversal

>=1.0.0, <1.3.6 || >=2.0.0, <2.0.7 · fixed in 1.3.6, 2.0.7

Apache Kerby has a bypass the Kerberos pre-authentication check

• Authentication bypass
• CWE-358

<2.1.2 · fixed in 2.1.2

Apache Kerby vulnerable to denial of service

• Denial of service

<2.1.2 · fixed in 2.1.2

Apicurio Registry is vulnerable to denial of service through XML entity expansion

• Denial of service

>=3.3.0, <3.3.1 || <3.2.6 · fixed in 3.3.1, 3.2.6

Apicurio Registry allows upload of WSDL raising HTTP request

• Server-side request forgery (SSRF)

>=3.3.0, <3.3.1 || <3.2.6 · fixed in 3.3.1, 3.2.6

Duplicate Advisory: Authentication bypass via jwt algorithm confusion

• Weak cryptography or TLS

<26.6.4 · fixed in 26.6.4

Apicurio Registry utilities allow SSRF and denial of service through XML parsing

• XML external entities (XXE)

>=3.3.0, <3.3.1 || <3.2.6 · fixed in 3.3.1, 3.2.6

nextflow auth login command has incorrect default permissions

• Broken access control

>=25.09.2-edge, <25.10.6 || >=26.00.0-edge, <26.04.3 · fixed in 25.10.6, 26.04.3

Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token

• Authentication bypass

* · no fixed version yet

Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass

• Broken access control

* · no fixed version yet

Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

• Path traversal

* · no fixed version yet

Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison

• CWE-1025

* · no fixed version yet

Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

• Cross-site scripting (XSS)

* · no fixed version yet

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

• Weak cryptography or TLS

<16.1.1 · fixed in 16.1.1

OpenAM Arbitrary OAuth Token Minting via Push Registration

• Broken access control

<16.1.1 · fixed in 16.1.1

OpenAM has Unsafe Java Deserialization via SNS

• Insecure deserialization

<16.1.1 · fixed in 16.1.1

Apache Shiro shiro-guice module vulnerable to authentication bypass

• CWE-289

>=2.0.0, <3.0.0 · fixed in 3.0.0

Apache Shiro's "remember me" cookie age is not verified on the server.

• Authentication bypass

>=1.2.4, <3.0.0 · fixed in 3.0.0

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

• Broken access control

<16.1.1 · fixed in 16.1.1

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

• Insecure deserialization

<16.1.1 · fixed in 16.1.1

Jenkins Zowe zDevOps Plugin has a missing permission check

• Broken access control

<=1.1.3.50.ve350c9b · no fixed version yet

Payara Server Full has a Cross-Site Request Forgery vulnerability

• Cross-site request forgery (CSRF)
• Server-side request forgery (SSRF)

>=4.0.0, <7.2026.6 · fixed in 7.2026.6

Jenkins MCP Server Plugin missing a permission check

• Broken access control

<0.178.vffe5a · fixed in 0.178.vffe5a

Jenkins FitNesse Plugin stores passwords unencrypted

• CWE-256

<=1.36 · no fixed version yet