Maven Advisories.

Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch

• Weak cryptography or TLS

<2.8.0 · fixed in 2.8.0

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

• Cross-site scripting (XSS)

<7.22.0 · fixed in 7.22.0

jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

• Denial of service

>=2.19.0, <2.21.1 || >=2.15.0, <2.18.6 · fixed in 2.21.1, 2.18.6

Junrar has an arbitrary file write due to backslash Path Traversal bypass in LocalFolderExtractor on Linux/Unix

• Path traversal

<7.5.8 · fixed in 7.5.8

Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes

• Privilege escalation
• Broken access control

<26.5.2 · fixed in 26.5.2

Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass

• Weak cryptography or TLS

<26.4.4 · fixed in 26.4.4

Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner

• Denial of service

<=4.0.1 · no fixed version yet

PSI Probe: Broken access control can lead to DoS

• Broken access control
• Denial of service

<=5.3.0 · no fixed version yet

PSI Probe vulnerable to Server-Side Request Forgery

• Server-side request forgery (SSRF)

<=5.3.0 · no fixed version yet

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

• Code injection
• Insecure deserialization

<0.12.0 · fixed in 0.12.0

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

• Other injection
• Insecure deserialization

<0.4.0 · fixed in 0.4.0

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

• CWE-346

>=4.15.0, <4.18.0 · fixed in 4.18.0

Apache Camel Deserializes Untrusted Data in its LevelDB Component

• Insecure deserialization

>=3.0.0, <4.10.9 || >=4.11.0, <4.14.5 || >=4.15.0, <4.18.0 · fixed in 4.10.9, 4.14.5, 4.18.0

carbon-apimgt does not properly restrict uploaded files

• Unrestricted file upload

<9.32.167 · fixed in 9.32.167

Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

• Broken access control

<=26.5.3 · no fixed version yet

mingSoft MCMS does not properly restrict file uploads

• Broken access control
• Unrestricted file upload

<=6.1.1 · no fixed version yet

Jenkins has a build information disclosure vulnerability through Run Parameter

• Information disclosure

>=2.542, <2.551 || <2.541.2 · fixed in 2.551, 2.541.2

Jenkins has a stored XSS vulnerability in node offline cause description

• Cross-site scripting (XSS)

>=2.542, <2.551 || >=2.483, <2.541.2 · fixed in 2.551, 2.541.2

Apache Tomcat - Security constraint bypass with HTTP/0.9

• CWE-20

>=11.0.0-M1, <11.0.15 || >=10.1.0-M1, <10.1.50 || <9.0.113 · fixed in 11.0.15, 10.1.50, 9.0.113

Apache Tomcat has an Improper Input Validation vulnerability

• Weak cryptography or TLS
• CWE-20

>=11.0.0-M1, <11.0.18 || >=10.1.0-M7, <10.1.52 || >=9.0.83, <9.0.115 · fixed in 11.0.18, 10.1.52, 9.0.115

Apache Tomcat - Client certificate verification bypass

• Weak cryptography or TLS
• CWE-20

>=11.0.0-M1, <11.0.15 || >=10.1.0-M1, <10.1.50 || >=9.0.0-M1, <9.0.113 || >=8.5.0, <=8.5.100 · fixed in 11.0.15, 10.1.50, 9.0.113

Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

• Broken access control

>=1.1.0, <2.8.0 · fixed in 2.8.0

Wildfly Elytron integration susceptible to brute force attacks via CLI

• Authentication bypass

>=32.0.0.Beta1, <32.0.0.Beta3 || <31.0.3.Final · fixed in 32.0.0.Beta3, 31.0.3.Final

Apache Avro Java SDK is Vulnerable to Code Injection

• Code injection

>=1.12.0, <1.12.1 || <1.11.5 · fixed in 1.12.1, 1.11.5

XWiki vulnerable to click-jacking through CSS injection in comments

• CWE-1021

>=17.5.0, <17.9.0 || >=17.0.0-rc-1, <17.4.6 || <16.10.13 · fixed in 17.9.0, 17.4.6, 16.10.13

Leaky JWTs in OpenMetadata exposing highly-privileged bot users

• Privilege escalation

<1.11.8 · fixed in 1.11.8

Apache Druid Vulnerable to Authentication Bypass

• Authentication bypass

>=0.17.0, <36.0.0 · fixed in 36.0.0

Keycloak logs sensitive headers

• Other injection

<26.5.6 · fixed in 26.5.6

Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability

• CWE-208

<2.1.0 · fixed in 2.1.0

Keycloak affected by improper invitation token validation

• Weak cryptography or TLS

>=26.5.0, <26.5.3 || <26.2.13 || >=26.3.0, <26.4.9 · fixed in 26.5.3, 26.2.13, 26.4.9

Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

• Privilege escalation

<26.2.13 || >=26.5.0, <26.5.3 || >=26.3.0, <26.4.9 · fixed in 26.2.13, 26.5.3, 26.4.9

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

• CWE-358

>=26.5.0, <26.5.3 || <26.4.9 · fixed in 26.5.3, 26.4.9

Apache Shiro has an Authentication Bypass

• CWE-289

<2.1.0 · fixed in 2.1.0

Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log

• Other injection

<2026.01 · fixed in 2026.01

Neo4j Enterprise and Community vulnerable to a potential information disclosure

• Information disclosure

<5.26.21 || >=2025.01.0, <2026.01.3 · fixed in 5.26.21, 2026.01.3

Apache Syncope: Reflected XSS on Enduser Login

• Cross-site scripting (XSS)

>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4 · fixed in 3.0.16, 4.0.4

Apache Syncope: Console XXE on Keymaster parameters

• XML external entities (XXE)

>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4 · fixed in 3.0.16, 4.0.4

JinJava Bypass through ForTag leads to Arbitrary Java Execution

• Code injection

>=2.8.0, <2.8.3 || <2.7.6 · fixed in 2.8.3, 2.7.6

Crafter CMS has Improper Control of Dynamically-Managed Code Resources

• CWE-913

>=4.0.0, <4.5.0 · fixed in 4.5.0

H2O has an External Control of File Name or Path vulnerability

• Path traversal

<=3.46.0.1 · no fixed version yet

Keycloak Server-Side Request Forgery (SSRF) vulnerability

• Server-side request forgery (SSRF)

<=26.5.2 · no fixed version yet

Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes

• Privilege escalation

>=26.5.0, <26.5.2 || <26.4.9 · fixed in 26.5.2, 26.4.9

Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names

• Denial of service
• CWE-20

<2.2.39.Final || >=2.4.0.Alpha1, <2.4.0.Beta1 || >=2.3.0.Alpha1, <2.3.21.Final · fixed in 2.2.39.Final, 2.4.0.Beta1, 2.3.21.Final

jsonrpc4j has Infinite Loop in RPC Stream Writer

• Denial of service

<1.7.0 · fixed in 1.7.0

Quick-Media Batik Codec FIX package has Code Injection vulnerability

• Code injection

<=3.0.0 · no fixed version yet

weixin4j has Improperly Controlled Sequential Memory Allocation

• CWE-1325

<=1.10.2 · no fixed version yet

Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec

• Weak cryptography or TLS

<=3.0.0 · no fixed version yet

AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

• XML external entities (XXE)

>=1.4.0, <3.27.7 · fixed in 3.27.7

Hibernate Reactive Vulnerable to DoS via Connection Pool Exhaustion

• Denial of service

<4.2.1 · fixed in 4.2.1

Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

• Weak cryptography or TLS
• Authentication bypass

<=26.5.2 · no fixed version yet

Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector

• Insecure deserialization

<2.12.0 · fixed in 2.12.0

Apache Continuum vulnerable to Command Injection through Installations REST API

• Command injection

<=1.4.2 · no fixed version yet

Apache Hadoop HDFS Native Client has Out-of-bounds Write Vulnerability

• Memory corruption

>=3.2.0, <3.4.2 · fixed in 3.4.2

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

• Cross-site scripting (XSS)

>=7.0-milestone-2, <16.10.12 || >=17.0.0-rc-1, <17.4.5 || >=17.5.0-rc-1, <17.8.0-rc-1 · fixed in 16.10.12, 17.4.5, 17.8.0-rc-1

Hibernate vulnerable to SQL Injection

• SQL injection

>=5.2.8, <5.3.38 · fixed in 5.3.38

Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide

• CWE-208

>=6.3.8, <6.3.9 || >=6.4.4, <6.4.5 · fixed in 6.3.9, 6.4.5

Logback allows an attacker to instantiate classes already present on the class path

• CWE-20

<1.5.25 · fixed in 1.5.25

Apache Solr: Insufficient file-access checking in standalone core-creation requests

• CWE-20

>=8.6.0, <9.10.1 · fixed in 9.10.1

Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin

• Broken access control

>=5.3.0, <9.10.1 · fixed in 9.10.1

Keycloak Admin REST API exposes backend schema and rules

• Broken access control

<=26.2.5 · no fixed version yet