Maven Advisories.

Keycloak services allows the issuance of access and refresh tokens for disabled users

• Broken access control
• CWE-840

>=26.5.0, <26.5.2 || <26.4.9 · fixed in 26.5.2, 26.4.9

Keycloak does not validate and update refresh token usage atomically

• Race condition

<=26.2.5 · no fixed version yet

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

• Code injection

<2.2.0 · fixed in 2.2.0

XDocReport affected by an XML External Entity (XXE) vulnerability

• XML external entities (XXE)

>=0.9.2, <2.0.4 · fixed in 2.0.4

Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)

• Server-side request forgery (SSRF)

<=25.0.3 · no fixed version yet

Apache Linkis: Password Exposure

• Information disclosure

>=1.0.0, <1.8.0 · fixed in 1.8.0

Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

• Path traversal
• CWE-20

>=1.3.0, <1.8.0 · fixed in 1.8.0

risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability

• Other injection
• SQL injection

<=9.7.0-M5 · no fixed version yet

Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability

• Server-side request forgery (SSRF)

<=26.1.11 · no fixed version yet

PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams

• Cross-site scripting (XSS)

<1.2026.0 · fixed in 1.2026.0

Vert.x Web static handler component cache can be manipulated to deny the access to static files

• HTTP request smuggling

<4.5.24 || >=5.0.0.CR1, <5.0.7 · fixed in 4.5.24, 5.0.7

Keycloak has an improper input validation vulnerability

• CWE-20

<=26.2.5 · no fixed version yet

Apache Camel camel-neo4j component is vulnerable to cypher injection

• Other injection
• SQL injection

>=4.10.0, <4.10.8 || >=4.14.0, <4.14.3 || >=4.15.0, <4.17.0 · fixed in 4.10.8, 4.14.3, 4.17.0

Jervis's AES CBC Mode is Without Authentication

• Authentication bypass
• Weak cryptography or TLS

<2.2 · fixed in 2.2

Jervis Has a JWT Algorithm Confusion Vulnerability

• Weak cryptography or TLS

<2.2 · fixed in 2.2

Jervis Has Weak Random for Timing Attack Mitigation

• Weak cryptography or TLS

<2.2 · fixed in 2.2

Jervis's Salt for PBKDF2 derived from password

• Weak cryptography or TLS

<2.2 · fixed in 2.2

Jervis Has a SHA-256 Hex String Padding Bug

• Weak cryptography or TLS

<2.2 · fixed in 2.2

Jervis has Deterministic AES IV Derivation from Passphrase

• Weak cryptography or TLS
• CWE-340

<2.2 · fixed in 2.2

Jervis Has a RSA PKCS#1 Padding Vulnerability

• Weak cryptography or TLS

<2.2 · fixed in 2.2

Apache Struts 2 is Missing XML Validation

• XML external entities (XXE)
• CWE-112

>=2.0.0 · no fixed version yet

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

• SQL injection

<2.4.5 · fixed in 2.4.5

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

• Information disclosure

<2.4.6 · fixed in 2.4.6

FASTJSON Includes Functionality from Untrusted Control Sphere

• CWE-829

<1.2.48 · fixed in 1.2.48

Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

• CWE-551

<=26.5.0 · no fixed version yet

Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing

• Insecure deserialization

<=8.3.0 · no fixed version yet

Bio-Formats has an XML External Entity (XXE) vulnerability

• XML external entities (XXE)

<=8.3.0 · no fixed version yet

OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

• Code injection

>=1.5.0, <1.11.4 · fixed in 1.11.4

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

• CWE-20

>=2.3.0.Alpha1, <2.3.21.Final || <2.2.39.Final · fixed in 2.3.21.Final, 2.2.39.Final

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

• Denial of service

<3.20.5 || >=3.21.0, <3.27.2 || >=3.30.0, <3.31.0 · fixed in 3.20.5, 3.27.2, 3.31.0

Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

• Server-side request forgery (SSRF)
• CWE-20

<2025.1.6 || >=2025.2.0, <2025.2.3 · fixed in 2025.1.6, 2025.2.3

Apache SIS has Improper Restriction of XML External Entity Reference vulnerability

• XML external entities (XXE)

>=0.4, <1.6 · fixed in 1.6

MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation

• Denial of service

<0.9.11 · fixed in 0.9.11

Apache Kyuubi Server vulnerable to Path Traversal

• Path traversal
• CWE-27

>=1.6.0, <1.10.3 · fixed in 1.10.3

Vaadin vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=23.1.0, <23.6.6 || >=24.0.0, <24.8.14 || >=24.9.0, <24.9.7 · fixed in 23.6.6, 24.8.14, 24.9.7

Apache StreamPipes has Improper Privilege Management issue

• Privilege escalation

>=0.69.0, <0.98.0 · fixed in 0.98.0

Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

• Insecure deserialization

>=26.3.0, <26.4.6 || <26.2.11 · fixed in 26.4.6, 26.2.11

Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization

• Insecure deserialization

>=1.20.0, <2.7.0 · fixed in 2.7.0

Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data

• Denial of service

<8.19.9 || >=9.0.0, <9.1.9 || >=9.2.0, <9.2.3 · fixed in 8.19.9, 9.1.9, 9.2.3

Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

• Denial of service

<8.19.8 || >=9.0.0, <9.1.8 || >=9.2.0, <9.2.2 · fixed in 8.19.8, 9.1.8, 9.2.2

Apache Log4j does not verify the TLS hostname in its Socket Appender

• Weak cryptography or TLS

>=2.0-beta9, <2.25.3 · fixed in 2.25.3

Amazon S3 Encryption Client for Java has a Key Commitment Issue

• Weak cryptography or TLS

<4.0.0 · fixed in 4.0.0

jose4j is vulnerable to DoS via compressed JWE content

• CWE-1259

<0.9.6 · fixed in 0.9.6

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

• Weak cryptography or TLS
• CWE-115

<1.0.0 · fixed in 1.0.0

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

• Other injection

>=4.2.0.Alpha1, <4.2.8.Final || <4.1.129.Final · fixed in 4.2.8.Final, 4.1.129.Final

Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

• Authentication bypass
• Weak cryptography or TLS

>=7.0.0-alpha1, <8.19.8 || >=9.0.0-beta1, <9.1.8 || >=9.2.0, <9.2.2 · fixed in 8.19.8, 9.1.8, 9.2.2

snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function

• Other injection
• CWE-707

<1.7.0-beta1 · fixed in 1.7.0-beta1

aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

• Memory corruption
• Information disclosure

<2.0.3 · fixed in 2.0.3

Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations

• Broken access control

<1.0.96 · fixed in 1.0.96

Apache StreamPark: Use the user’s password as the secret key Vulnerability

• CWE-1240

>=2.0.0, <2.1.7 · fixed in 2.1.7

Apache StreamPark uses a Weak Encryption Algorithm

• Weak cryptography or TLS

>=2.0.0, <2.1.7 · fixed in 2.1.7

Apache StreamPark has a hard-coded encryption key

• Hard-coded credentials

>=2.0.0, <2.1.7 · fixed in 2.1.7

Apache HugeGraph-Server: RAFT and deserialization vulnerability

• Insecure deserialization

<1.7.0 · fixed in 1.7.0

PowerJob has a server-side request forgery vulnerability in PingPongUtils.java

• Server-side request forgery (SSRF)

<=5.1.2 · no fixed version yet

Race condition in the Okta Java SDK

• Race condition

>=11.0.0, <20.0.1 · fixed in 20.0.1

Improper Memory Cleanup in the Okta Java SDK

• Denial of service

>=21.0.0, <24.0.1 · fixed in 24.0.1

Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<2.3056 · fixed in 2.3056

Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability

• Path traversal

<=1.054 · no fixed version yet

Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

• CWE-282

<=371 · no fixed version yet

Jenkins Git client Plugin has an OS command injection vulnerability on agents in Git client Plugin

• Command injection

<6.4.1 · fixed in 6.4.1