agentprime Advisories: Maven

Keycloak has authentication bypass via jwt algorithm confusion

Tue, 03 Nov 2026 17:24:27 GMT

org.keycloak:keycloak-services <26.6.4, fixed in 26.6.4. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

Fri, 30 Oct 2026 23:00:12 GMT

org.mariadb.jdbc:mariadb-java-client >=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11, fixed in 3.3.7, 3.4.5, 3.5.11. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

Fri, 30 Oct 2026 23:00:07 GMT

org.mariadb.jdbc:mariadb-java-client >=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.10, fixed in 3.3.7, 3.4.5, 3.5.10. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

Fri, 30 Oct 2026 23:00:01 GMT

org.mariadb.jdbc:mariadb-java-client >=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11, fixed in 3.3.7, 3.4.5, 3.5.11. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

Fri, 30 Oct 2026 22:59:49 GMT

MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

Fri, 30 Oct 2026 22:59:45 GMT

NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

Fri, 30 Oct 2026 22:51:19 GMT

gov.nsa.emissary:emissary <8.51.0, fixed in 8.51.0. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Thu, 29 Oct 2026 16:39:03 GMT

org.keycloak:keycloak-services <26.6.4, fixed in 26.6.4. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Thu, 29 Oct 2026 16:38:31 GMT

org.keycloak:keycloak-services <26.6.4, fixed in 26.6.4. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Thu, 29 Oct 2026 16:37:57 GMT

org.keycloak:keycloak-services <26.6.4, fixed in 26.6.4. CVSS 4.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak vulnerable to authorization bypass via incorrect uri comparison

Thu, 29 Oct 2026 16:37:26 GMT

org.keycloak:keycloak-policy-enforcer <26.0.10, fixed in 26.0.10. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Thu, 29 Oct 2026 16:36:21 GMT

org.keycloak:keycloak-services <26.6.4, fixed in 26.6.4. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Wed, 28 Oct 2026 21:07:40 GMT

io.opentelemetry:opentelemetry-api <1.67.0, fixed in 1.67.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

Tue, 27 Oct 2026 15:33:42 GMT

org.xerial.snappy:snappy-java <1.1.10.9, fixed in 1.1.10.9. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

Tue, 27 Oct 2026 15:33:30 GMT

org.xerial.snappy:snappy-java <1.1.10.9, fixed in 1.1.10.9. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

Tue, 27 Oct 2026 15:33:22 GMT

org.xerial.snappy:snappy-java <1.1.10.9, fixed in 1.1.10.9. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

Tue, 27 Oct 2026 14:27:53 GMT

com.google.guava:guava >=4.0, <33.7.2, fixed in 33.7.2. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Wed, 21 Oct 2026 16:31:04 GMT

ognl:ognl <3.4.13, fixed in 3.4.13. CVSS 5.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Tue, 20 Oct 2026 21:08:33 GMT

org.a2aproject.sdk:a2a-java-sdk-transport-rest <1.3.0.Final, fixed in 1.3.0.Final. CVSS 5.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

Tue, 20 Oct 2026 21:08:06 GMT

org.a2aproject.sdk:a2a-java-sdk-http-client-android >=1.3.0.Final, <1.3.2.Final, fixed in 1.3.2.Final. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

Tue, 20 Oct 2026 21:06:22 GMT

org.a2aproject.sdk:a2a-java-sdk-server-common <1.3.0.Final, fixed in 1.3.0.Final. CVSS 5.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A2A Java SDK has a fail-open default task authorization

Tue, 20 Oct 2026 21:05:09 GMT

org.a2aproject.sdk:a2a-java-sdk-server-common <1.3.0.Final, fixed in 1.3.0.Final. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Tue, 20 Oct 2026 21:04:16 GMT

org.a2aproject.sdk:a2a-java-sdk-parent <1.3.0.Final, fixed in 1.3.0.Final. CVSS 5.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Fri, 16 Oct 2026 19:53:06 GMT

org.bytedeco:javacv <1.5.14, fixed in 1.5.14. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

Thu, 15 Oct 2026 20:09:47 GMT

com.github.junrar:junrar <7.6.1, fixed in 7.6.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

Fri, 09 Oct 2026 15:31:33 GMT

org.xerial.snappy:snappy-java *, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Hazelcast allows arbitrary member memory access by low-privileged client

Thu, 08 Oct 2026 22:10:29 GMT

com.hazelcast:hazelcast >=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0, fixed in 5.7.0. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Hazelcast has an authorization bypass in IMap Predicates API

Thu, 08 Oct 2026 22:09:34 GMT

com.hazelcast:hazelcast >=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0, fixed in 5.7.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

Thu, 08 Oct 2026 16:50:03 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1, fixed in 3.0.14. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Thu, 08 Oct 2026 16:49:59 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1, fixed in 3.0.14. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Thu, 08 Oct 2026 16:49:53 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.14 || >=2.2.0, <=2.16.1, fixed in 3.0.14. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Thu, 08 Oct 2026 16:49:46 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.14 || >=2.0.0, <=2.16.1, fixed in 3.0.14. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Thu, 08 Oct 2026 16:31:04 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.12 || >=2.0.0, <2.16.1, fixed in 3.0.12, 2.16.1. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Thu, 08 Oct 2026 16:30:58 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.12 || >=2.0.0, <2.16.1, fixed in 3.0.12, 2.16.1. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Thu, 08 Oct 2026 16:30:53 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.13 || >=2.0.0, <2.16.1, fixed in 3.0.13, 2.16.1. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Thu, 08 Oct 2026 16:30:46 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.13 || >=2.0.0, <2.16.1, fixed in 3.0.13, 2.16.1. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Thu, 08 Oct 2026 16:23:36 GMT

org.asynchttpclient:async-http-client >=3.0.0.Beta1, <3.0.13 || >=2.0.0, <2.16.1, fixed in 3.0.13, 2.16.1. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Wed, 07 Oct 2026 20:42:33 GMT

com.rabbitmq:amqp-client <5.36.1, fixed in 5.36.1. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

Wed, 07 Oct 2026 20:35:51 GMT

at.yawk.lz4:lz4-java <1.11.4, fixed in 1.11.4. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Wed, 07 Oct 2026 20:35:46 GMT

at.yawk.lz4:lz4-java <1.11.4, fixed in 1.11.4. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Wed, 07 Oct 2026 20:35:40 GMT

at.yawk.lz4:lz4-java <1.11.4, fixed in 1.11.4. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Wed, 07 Oct 2026 20:25:29 GMT

com.rabbitmq:amqp-client <5.36.0, fixed in 5.36.0. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Wed, 07 Oct 2026 16:19:22 GMT

com.rabbitmq:amqp-client <5.35.0, fixed in 5.35.0. CVSS 5.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Wed, 07 Oct 2026 16:17:50 GMT

at.yawk.lz4:lz4-java <1.11.2, fixed in 1.11.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

Wed, 07 Oct 2026 16:17:47 GMT

at.yawk.lz4:lz4-java <1.11.2, fixed in 1.11.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Snowflake drivers writes sensitive information to logs

Mon, 05 Oct 2026 22:55:47 GMT

github.com/snowflakedb/gosnowflake <=1.19.1, no fixed version yet. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Mon, 05 Oct 2026 22:53:10 GMT

com.capacitorjs:core >=6.0.0, <6.2.2 || >=7.0.0, <7.6.9 || >=8.5.0, <8.5.1 || >=8.3.5, <8.4.3 || >=8.0.0, <=8.3.4, fixed in 6.2.2, 7.6.9, 8.5.1, 8.4.3. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Fri, 02 Oct 2026 18:27:17 GMT

eu.copernik:copernik-xml-factory <0.1.2, fixed in 0.1.2. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

Thu, 01 Oct 2026 15:20:27 GMT

com.fasterxml.jackson.core:jackson-core >=2.19.0, <2.21.7 || >=2.22.0, <2.22.3 || >=2.8.0, <2.18.11, fixed in 2.21.7, 2.22.3, 2.18.11. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Thu, 01 Oct 2026 15:19:21 GMT

com.fasterxml.jackson.core:jackson-core >=2.17.0, <2.18.11 || >=2.19.0, <2.21.7 || >=2.22.0, <2.22.3, fixed in 2.18.11, 2.21.7, 2.22.3. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.