Security Digest · page 1 of 4
Critical Maven advisories
334 critical advisories for Maven packages since October 2023, newest first. Check your project with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
- AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host CVE-2026-107282 CVSS 9.4 Critical
org.asynchttpclient:async-http-client>= 3.0.0, <= 3.0.12 → fixed in 3.0.13;org.asynchttpclient:async-http-client>= 2.0.0, <= 2.16.0 → fixed in 2.16.1 - Hazelcast allows arbitrary member memory access by low-privileged client CVE-2026-107726 CVSS 9.3 Critical
com.hazelcast:hazelcast= 5.6.0 → fixed in 5.7.0;com.hazelcast:hazelcast>= 5.5.0, < 5.5.10 → fixed in 5.7.0;com.hazelcast:hazelcast< 5.4.5 → fixed in 5.7.0 - Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922 CVSS 9.3 Critical
@capacitor/android>= 6.0.0, < 6.2.2 → fixed in 6.2.2;@capacitor/android>= 7.0.0, < 7.6.9 → fixed in 7.6.9;@capacitor/ios>= 6.0.0, < 6.2.2 → fixed in 6.2.2; +17 more packages - http4s-scala-xml has an XML External Entity (XXE) processing issue CVE-2026-61741 CVSS 9.3 Critical
org.http4s:http4s-scala-xml_2.12<= 0.24.0 → fixed in 0.24.1;org.http4s:http4s-scala-xml_2.13<= 0.24.0 → fixed in 0.24.1;org.http4s:http4s-scala-xml_2.13>= 1.0.0-M1, <= 1.0.0-M38.1 → fixed in 1.0.0-M39; +2 more packages - Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message… CVE-2026-85724 CVSS 9.6 Critical
io.moquette:moquette-broker<= 0.18.0 → fixed in 0.18.1 - org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue CVE-2025-53837 CVSS 9.9 Critical
org.xwiki.rendering:xwiki-rendering-xml< 14.10.2 → fixed in 14.10.2 - Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) CVE-2026-69204 CVSS 9.2 Critical
org.http4s:http4s-ember-core_2.12<= 0.23.34 → fixed in 0.23.35;org.http4s:http4s-ember-core_2.13<= 0.23.34 → fixed in 0.23.35;org.http4s:http4s-ember-core_3<= 0.23.34 → fixed in 0.23.35; +2 more packages - Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover CVE-2026-11746 CVSS 9.4 Critical
com.linecorp.centraldogma:centraldogma-server< 0.84.0 → fixed in 0.84.0 - Apache FreeMarker template loading mechanism vulnerable to path traversal CVE-2026-84939 CVSS 9.1 Critical
org.freemarker:freemarker>= 2.2.0, <= 2.3.34 → fixed in 2.3.35 - Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 CVSS 9.1 Critical
io.netty:netty-handler>= 4.2.0.Final, <= 4.2.16.Final → fixed in 4.2.17.Final;io.netty:netty-handler<= 4.1.136.Final → fixed in 4.1.137.Final - Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) CVE-2026-55565 CVSS 9.9 Critical
org.yamcs:yamcs-core>= 5.13.0, <= 5.13.1 → fixed in 5.13.2;org.yamcs:yamcs-core<= 5.12.7 → fixed in 5.12.8 - Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) CVE-2026-55559 CVSS 9.8 Critical
org.yamcs:yamcs-core>= 5.13.0, <= 5.13.1 → fixed in 5.13.2;org.yamcs:yamcs-core<= 5.12.7 → fixed in 5.12.8 - Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` CVE-2026-55511 CVSS 9.1 Critical
org.yamcs:yamcs-core>= 5.13.0, <= 5.13.1 → fixed in 5.13.2;org.yamcs:yamcs-core<= 5.12.7 → fixed in 5.12.8 - Spring Framework Improper Path Limitation in XsltView CVE-2026-47884 CVSS 9.8 Critical
org.springframework:spring-webmvc<= 5.2.25.RELEASE → no fix listed;org.springframework:spring-webmvc>= 5.3.0, <= 5.3.49 → no fix listed;org.springframework:spring-webmvc>= 6.0.0, <= 6.0.30 → no fix listed; +3 more packages - Spring Framework Server Sent Event stream corruption while rendering fragments CVE-2026-47890 CVSS 9.8 Critical
org.springframework:spring-webflux>= 6.2.0, <= 6.2.19 → no fix listed;org.springframework:spring-webflux>= 7.0.0, <= 7.0.8 → fixed in 7.0.9;org.springframework:spring-webmvc>= 6.2.0, <= 6.2.19 → no fix listed; +1 more packages - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-47892 CVSS 9.8 Critical
org.springframework:spring-webflux>= 5.2.5.RELEASE, <= 5.2.25.RELEASE → no fix listed;org.springframework:spring-webflux>= 5.3.0, <= 5.3.49 → no fix listed;org.springframework:spring-webflux>= 6.0.0, <= 6.0.30 → no fix listed; +3 more packages - Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability CVE-2026-68525 CVSS 9.1 Critical
org.apache.tomcat:tomcat>= 11.0.0-M1, < 11.0.25 → fixed in 11.0.25;org.apache.tomcat:tomcat>= 10.1.0-M1, < 10.1.58 → fixed in 10.1.58;org.apache.tomcat:tomcat>= 9.0.0-M1, < 9.0.121 → fixed in 9.0.121; +12 more packages - Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability CVE-2026-65182 CVSS 9.1 Critical
org.apache.tomcat:tomcat>= 11.0.0-M1, < 11.0.25 → fixed in 11.0.25;org.apache.tomcat:tomcat>= 10.1.0-M1, < 10.1.58 → fixed in 10.1.58;org.apache.tomcat:tomcat>= 9.0.0-M1, < 9.0.121 → fixed in 9.0.121; +12 more packages - Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability CVE-2026-65905 CVSS 9.8 Critical
org.apache.tomcat:tomcat>= 11.0.0-M1, < 11.0.25 → fixed in 11.0.25;org.apache.tomcat:tomcat>= 10.1.0-M1, < 10.1.58 → fixed in 10.1.58;org.apache.tomcat:tomcat>= 9.0.0.M1, < 9.0.121 → fixed in 9.0.121; +12 more packages - Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow… CVE-2026-78329 CVSS 9.8 Critical
org.apache.camel:camel-undertow>= 4.11.0, < 4.14.9 → fixed in 4.14.9;org.apache.camel:camel-undertow>= 4.15.0, < 4.18.4 → fixed in 4.18.4;org.apache.camel:camel-undertow>= 4.19.0, < 4.22.0 → fixed in 4.22.0 - Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers… CVE-2026-71300 CVSS 9.8 Critical
org.apache.camel:camel-atmosphere-websocket>= 4.0.0, < 4.14.9 → fixed in 4.14.9;org.apache.camel:camel-atmosphere-websocket>= 4.15.0, < 4.18.4 → fixed in 4.18.4;org.apache.camel:camel-atmosphere-websocket>= 4.19.0, < 4.22.0 → fixed in 4.22.0 - Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without… CVE-2026-66906 CVSS 9.1 Critical
org.apache.camel:camel-azure-storage-blob>= 4.0.0, < 4.14.9 → fixed in 4.14.9;org.apache.camel:camel-azure-storage-blob>= 4.15.0, < 4.18.4 → fixed in 4.18.4;org.apache.camel:camel-azure-storage-blob>= 4.19.0, < 4.22.0 → fixed in 4.22.0 - GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers CVE-2026-76904 CVSS 9.8 Critical
org.geotools.jdbc:gt-jdbc-postgis= 35.0 → fixed in 35.1;org.geotools.jdbc:gt-jdbc-postgis>= 34.0, < 34.5 → fixed in 34.5;org.geotools.jdbc:gt-jdbc-postgis>= 30.5, < 33.6 → fixed in 33.6 - Keycloak: Unauthenticated account takeover via reset-credentials flow bypass CVE-2026-18963 CVSS 9.1 Critical
org.keycloak:keycloak-services>= 26.0.0, < 26.4.15 → fixed in 26.4.15;org.keycloak:keycloak-services>= 26.5.0, < 26.6.6 → fixed in 26.6.6;org.keycloak:keycloak-services>= 26.7.0, < 26.7.2 → fixed in 26.7.2 - Apache Ranger has a Command Injection vulnerability CVE-2026-28672 CVSS 9.8 Critical
org.apache.ranger:ranger>= 0.6.0, <= 2.8.0 → no fix listed - Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 CVSS 9.3 Critical
org.bouncycastle:bc-fips< 1.0.2.7 → fixed in 1.0.2.7;org.bouncycastle:bc-fips>= 2.0.0, < 2.0.2 → fixed in 2.0.2;org.bouncycastle:bc-fips>= 2.1.0, < 2.1.3 → fixed in 2.1.3; +3 more packages - OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVE-2026-62379 CVSS 9.8 Critical
org.openidentityplatform.openam:openam-core<= 16.1.1 → fixed in 16.1.2 - OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check CVE-2026-73644 CVSS 9.6 Critical
org.openidentityplatform.opendj:opendj-server-legacy<= 5.1.1 → fixed in 5.1.2 - OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass CVE-2026-62263 CVSS 9.2 Critical
org.openidentityplatform.openam:openam-auth-webauthn<= 16.1.1 → fixed in 16.1.2 - OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway GHSA-68r5-9hpg-7qw9 CVSS 9.4 Critical
org.openidentityplatform.opendj:opendj-dsml-servlet<= 5.1.1 → fixed in 5.1.2 - fastjson has a remote code execution (RCE) vulnerability CVE-2026-16723 CVSS 9.0 Critical
com.alibaba:fastjson>= 1.2.68, <= 1.2.83 → no fix listed - Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy CVE-2026-56140 CVSS 9.8 Critical
org.apache.camel:camel-aws2-sns>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-aws2-sns>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-aws2-sns>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer CVE-2026-40047 CVSS 9.1 Critical
org.apache.camel:camel-docling>= 4.15.0, < 4.18.3 → fixed in 4.18.3 - Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated… CVE-2026-46454 CVSS 9.8 Critical
org.apache.camel:camel-cometd>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-cometd>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-cometd>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open… CVE-2026-53913 CVSS 9.8 Critical
org.apache.camel:camel-keycloak>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-keycloak>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier… CVE-2026-46455 CVSS 9.8 Critical
org.apache.camel:camel-keycloak>= 4.18.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-keycloak>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) CVE-2026-48205 CVSS 9.1 Critical
org.apache.camel:camel-dns>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-dns>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-dns>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP… CVE-2026-48204 CVSS 9.8 Critical
org.apache.camel:camel-mongodb-gridfs>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-mongodb-gridfs>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-mongodb-gridfs>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message… CVE-2026-46456 CVSS 9.8 Critical
org.apache.camel:camel-aws2-sqs>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-aws2-sqs>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-aws2-sqs>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no… CVE-2026-43867 CVSS 9.8 Critical
org.apache.camel:camel-pqc>= 4.18.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-pqc>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header… CVE-2026-48203 CVSS 9.1 Critical
org.apache.camel:camel-solr>= 4.0.0, < 4.14.8 → fixed in 4.14.8;org.apache.camel:camel-solr>= 4.15.0, < 4.18.3 → fixed in 4.18.3;org.apache.camel:camel-solr>= 4.19.0, < 4.21.0 → fixed in 4.21.0 - LaunchServer FileServerHandler has an unauthenticated path traversal issue CVE-2026-54617 CVSS 9.8 Critical
pro.gravit.launcher:launchserver-api<= 5.7.11 → no fix listed - OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVE-2026-45052 CVSS 9.3 Critical
org.openidentityplatform.openam:openam-federation-library<= 16.0.6 → fixed in 16.1.1 - OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage CVE-2026-45051 CVSS 9.2 Critical
org.openidentityplatform.openam:openam-auth-webauthn<= 16.0.6 → fixed in 16.1.1 - xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro CVE-2026-44179 CVSS 9.9 Critical
com.xwiki.pro:xwiki-pro-macros>= 1.13, < 1.14.5 → fixed in 1.14.5 - expr-eval vulnerable to Code Execution CVE-2026-12866 CVSS 9.2 Critical
expr-eval<= 2.0.2 → no fix listed;org.webjars.npm:expr-eval<= 2.0.2 → no fix listed - OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) CVE-2026-44203 CVSS 9.3 Critical
org.openidentityplatform.openam:openam-oauth2>= 13.0.0, < 16.1.1 → fixed in 16.1.1 - OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI CVE-2026-46495 CVSS 9.2 Critical
org.openidentityplatform.opendj:opendj-server-legacy<= 5.1.0 → fixed in 5.1.1 - OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete) CVE-2026-56120 CVSS 9.6 Critical
io.openremote:openremote-manager< 1.25.0 → fixed in 1.25.0 - Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure CVE-2026-32966 CVSS 9.8 Critical
org.apache.dolphinscheduler:dolphinscheduler-api< 3.4.2 → fixed in 3.4.2 - Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks CVE-2026-32967 CVSS 9.1 Critical
org.apache.dolphinscheduler:dolphinscheduler-api< 3.4.2 → fixed in 3.4.2 - HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory CVE-2026-55471 CVSS 9.2 Critical
ca.uhn.hapi.fhir:org.hl7.fhir.utilities<= 6.9.9 → fixed in 6.9.10 - SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component CVE-2026-39006 CVSS 9.8 Critical
org.snmp4j:snmp4j-agent<= 3.8.3 → no fix listed - Apache CXF has Improper Restriction of XML External Entity Reference CVE-2026-49875 CVSS 9.8 Critical
org.apache.cxf:cxf-core>= 4.2.0, < 4.2.2 → fixed in 4.2.2;org.apache.cxf:cxf-core< 4.1.7 → fixed in 4.1.7 - Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl CVE-2026-50633 CVSS 9.8 Critical
org.apache.cxf:cxf-integration-jca>= 4.2.0, < 4.2.2 → fixed in 4.2.2;org.apache.cxf:cxf-integration-jca< 4.1.7 → fixed in 4.1.7 - Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control CVE-2026-50628 CVSS 9.8 Critical
org.apache.cxf:cxf-rt-rs-security-oauth2>= 4.2.0, < 4.2.2 → fixed in 4.2.2;org.apache.cxf:cxf-rt-rs-security-oauth2< 4.1.7 → fixed in 4.1.7 - Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator CVE-2026-50627 CVSS 9.1 Critical
org.apache.cxf:cxf-rt-rs-security-oauth2>= 4.2.0, < 4.2.2 → fixed in 4.2.2;org.apache.cxf:cxf-rt-rs-security-oauth2< 4.1.7 → fixed in 4.1.7 - Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory CVE-2026-50632 CVSS 9.8 Critical
org.apache.cxf:cxf-rt-transports-jms>= 4.2.0, < 4.2.2 → fixed in 4.2.2;org.apache.cxf:cxf-rt-transports-jms>= 4.1.0, < 4.1.7 → fixed in 4.1.7;org.apache.cxf:cxf-rt-transports-jms< 3.6.12 → fixed in 3.6.12 - Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path CVE-2026-50076 CVSS 9.1 Critical
org.apache.fory:fory-core< 1.1.0 → fixed in 1.1.0 - Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass CVE-2026-47065 CVSS 9.8 Critical
org.apache.mina:mina-core>= 2.2.0, < 2.2.8 → fixed in 2.2.8;org.apache.mina:mina-core>= 2.1.0, < 2.1.13 → fixed in 2.1.13;org.apache.mina:mina-core< 2.0.29 → fixed in 2.0.29 - Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override CVE-2026-46562 CVSS 9.8 Critical
org.yamcs:yamcs-core< 5.12.7 → fixed in 5.12.7 - Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection CVE-2026-46621 CVSS 9.1 Critical
org.yamcs:yamcs-core< 5.12.7 → fixed in 5.12.7 - XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash CVE-2026-23734 CVSS 9.3 Critical
org.xwiki.commons:xwiki-commons-classloader-api>= 4.2-milestone-2, < 16.10.17 → fixed in 16.10.17;org.xwiki.commons:xwiki-commons-classloader-api>= 17.0.0-rc-1, < 17.4.9 → fixed in 17.4.9;org.xwiki.commons:xwiki-commons-classloader-api>= 17.5.0, < 17.10.3 → fixed in 17.10.3; +1 more packages - XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} CVE-2026-33137 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-rest-server>= 15.10.6, < 16.10.17 → fixed in 16.10.17;org.xwiki.platform:xwiki-platform-rest-server>= 17.0.0-rc-1, < 17.4.9 → fixed in 17.4.9;org.xwiki.platform:xwiki-platform-rest-server>= 17.5.0, < 17.10.3 → fixed in 17.10.3; +1 more packages - Apache CXF has an LDAP injection vulnerability CVE-2026-44930 CVSS 9.8 Critical
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap= 4.2.0 → fixed in 4.2.1;org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap>= 4.1.0, < 4.1.6 → fixed in 4.1.6;org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap< 3.6.11 → fixed in 3.6.11 - Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` CVE-2026-44632 CVSS 9.1 Critical
org.yamcs:yamcs-core< 5.12.7 → fixed in 5.12.7 - GlassFish's Administration Console is Vulnerable to RCE CVE-2026-2586 CVSS 9.1 Critical
org.glassfish.main.admingui:console-common< 8.0.2 → fixed in 8.0.2;org.glassfish.jsftemplating:jsftemplating< 4.2.0 → fixed in 4.2.0 - Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering CVE-2026-47323 CVSS 9.8 Critical
org.apache.camel:camel-cxf-rest>= 3.18.0, < 4.14.6 → fixed in 4.14.6;org.apache.camel:camel-cxf-rest>= 4.15.0, < 4.18.2 → fixed in 4.18.2 - GlassFish's gadget handler is vulnerable to RCE CVE-2026-2587 CVSS 9.6 Critical
org.glassfish.main.admingui:admingui< 8.0.2 → fixed in 8.0.2;org.glassfish.jsftemplating:jsftemplating< 4.2.0 → fixed in 4.2.0 - Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading CVE-2026-8178 CVSS 9.2 Critical
com.amazon.redshift:redshift-jdbc42< 2.2.2 → fixed in 2.2.2 - Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy CVE-2026-45083 CVSS 9.8 Critical
io.goobi.viewer:viewer-core>= 4.8.0, <= 26.04 → no fix listed - sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) CVE-2026-45091 CVSS 9.1 Critical
sealed-env< 0.1.0-alpha.4 → fixed in 0.1.0-alpha.4;io.github.davidalmeidac:sealed-env-core< 0.1.0-alpha.4 → fixed in 0.1.0-alpha.4 - Apache Tomcat - HTTP/2 request headers not validated CVE-2026-41293 CVSS 9.8 Critical
org.apache.tomcat.embed:tomcat-embed-core>= 10.1.0-M1, < 10.1.55 → fixed in 10.1.55;org.apache.tomcat.embed:tomcat-embed-core>= 11.0.0-M1, < 11.0.22 → fixed in 11.0.22;org.apache.tomcat:tomcat>= 10.1.0-M1, < 10.1.55 → fixed in 10.1.55; +6 more packages - Mapfish Print: Remote Code Injection (RCE) in Dynamic table CVE-2026-44672 CVSS 9.3 Critical
org.mapfish.print:print-lib>= 3.23.0, < 3.28.28 → fixed in 3.28.28;org.mapfish.print:print-lib>= 3.29.0, < 3.30.30 → fixed in 3.30.30;org.mapfish.print:print-lib>= 3.31.0, < 3.31.21 → fixed in 3.31.21; +7 more packages - Apache Tomcat - Digest authenticator will authenticate any unknown user CVE-2026-43512 CVSS 9.8 Critical
org.apache.tomcat.embed:tomcat-embed-core< 9.0.118 → fixed in 9.0.118;org.apache.tomcat.embed:tomcat-embed-core>= 10.1.0-M1, < 10.1.55 → fixed in 10.1.55;org.apache.tomcat.embed:tomcat-embed-core>= 11.0.0-M1, < 11.0.22 → fixed in 11.0.22; +6 more packages - Security feature bypass vulnerability in Azure Key Vault Keys library for Java CVE-2026-33117 CVSS 9.1 Critical
com.azure:azure-security-keyvault-keys< 4.10.6 → fixed in 4.10.6 - Apache Tomcat - Security constraints not correctly applied CVE-2026-43515 CVSS 9.1 Critical
org.apache.tomcat.embed:tomcat-embed-core< 9.0.118 → fixed in 9.0.118;org.apache.tomcat.embed:tomcat-embed-core>= 10.1.0-M1, < 10.1.55 → fixed in 10.1.55;org.apache.tomcat.embed:tomcat-embed-core>= 11.0.0-M1, < 11.0.22 → fixed in 11.0.22; +6 more packages - Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation CVE-2026-27478 CVSS 9.1 Critical
io.unitycatalog:unitycatalog-server<= 0.4.0 → fixed in 0.4.1 - Apache Wicket has a Session Fixation issue CVE-2026-40010 CVSS 9.1 Critical
org.apache.wicket:wicket-auth-roles>= 8.0.0-M1, <= 8.17.0 → no fix listed;org.apache.wicket:wicket-auth-roles>= 9.0.0-M1, <= 9.22.0 → no fix listed;org.apache.wicket:wicket-auth-roles>= 10.0.0-M1, <= 10.8.0 → fixed in 10.9.0 - Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users CVE-2026-42555 CVSS 9.1 Critical
com.ritense.valtimo:document>= 12.0.0, < 12.32.0 → fixed in 12.32.0;com.ritense.valtimo:case>= 13.0.0, < 13.23.0 → fixed in 13.23.0;com.ritense.valtimo:contract>= 13.4.0, < 13.23.0 → fixed in 13.23.0 - Spring Cloud Config vulnerable to Path Traversal CVE-2026-40982 CVSS 9.1 Critical
org.springframework.cloud:spring-cloud-config-server>= 4.1.0, <= 4.1.9 → no fix listed;org.springframework.cloud:spring-cloud-config-server>= 4.2.0, <= 4.2.6 → no fix listed;org.springframework.cloud:spring-cloud-config-server>= 4.3.0, <= 4.3.2 → fixed in 4.3.3; +2 more packages - ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases CVE-2026-44221 CVSS 9.0 Critical
com.arcadedb:arcadedb-server>= 21.10.1, < 26.4.2 → fixed in 26.4.2 - Eclipse BaSyx Java Server SDK vulnerable to Path Traversal CVE-2026-7411 CVSS 10.0 Critical
org.eclipse.basyx:basyx.sdk< 2.0.0-milestone-10 → fixed in 2.0.0-milestone-10 - OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange CVE-2026-41258 CVSS 9.1 Critical
org.openmrs.api:openmrs-api>= 2.7.0, < 2.7.9 → fixed in 2.7.9;org.openmrs.api:openmrs-api>= 2.8.0, < 2.8.6 → fixed in 2.8.6 - Apache Polaris has an Improper Input Validation issue CVE-2026-42812 CVSS 9.4 Critical
org.apache.polaris:polaris-runtime-service>= 0.9.0, < 1.4.1 → fixed in 1.4.1 - Apache Polaris has an Improper Input Validation Issue CVE-2026-42810 CVSS 9.4 Critical
org.apache.polaris:polaris-core< 1.4.1 → fixed in 1.4.1 - Apache Polaris has an Improper Input Validation issue CVE-2026-42811 CVSS 9.4 Critical
org.apache.polaris:polaris-core< 1.4.1 → fixed in 1.4.1 - Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest CVE-2026-42027 CVSS 9.8 Critical
org.apache.opennlp:opennlp-tools>= 3.0.0-M1, < 3.0.0-M3 → fixed in 3.0.0-M3;org.apache.opennlp:opennlp-tools>= 2.0.0, < 2.5.9 → fixed in 2.5.9;org.apache.opennlp:opennlp-tools< 1.9.5 → fixed in 1.9.5 - Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns CVE-2026-41901 CVSS 9.0 Critical
org.thymeleaf:thymeleaf<= 3.1.4.RELEASE → fixed in 3.1.5.RELEASE;org.thymeleaf:thymeleaf-spring5<= 3.1.4.RELEASE → fixed in 3.1.5.RELEASE;org.thymeleaf:thymeleaf-spring6<= 3.1.4.RELEASE → fixed in 3.1.5.RELEASE - Apache Polaris has an Improper Input Validation Issue CVE-2026-42809 CVSS 9.4 Critical
org.apache.polaris:polaris-runtime-service< 1.4.1 → fixed in 1.4.1 - OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip) CVE-2026-40076 CVSS 9.4 Critical
org.openmrs.web:openmrs-web<= 2.7.8 → no fix listed;org.openmrs.web:openmrs-web>= 2.8.0, <= 2.8.5 → no fix listed - Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing CVE-2026-40682 CVSS 9.1 Critical
org.apache.opennlp:opennlp-tools>= 3.0.0-M1, < 3.0.0-M3 → fixed in 3.0.0-M3;org.apache.opennlp:opennlp-tools>= 2.0.0, < 2.5.9 → fixed in 2.5.9;org.apache.opennlp:opennlp-tools< 1.9.5 → fixed in 1.9.5 - Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix) CVE-2026-42779 CVSS 9.8 Critical
org.apache.mina:mina-core>= 2.1.0, < 2.1.12 → fixed in 2.1.12;org.apache.mina:mina-core>= 2.2.0, < 2.2.7 → fixed in 2.2.7 - Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix) CVE-2026-42778 CVSS 9.8 Critical
org.apache.mina:mina-core>= 2.1.0, < 2.1.12 → fixed in 2.1.12;org.apache.mina:mina-core>= 2.2.0, < 2.2.7 → fixed in 2.2.7 - Shopizer has a path traversal issue CVE-2026-36767 CVSS 10.0 Critical
com.shopizer:shopizer<= 2.16.0 → no fix listed - Jenkins GitHub Plugin has an XSS vulnerability CVE-2026-42523 CVSS 9.0 Critical
com.coravy.hudson.plugins.github:github< 1.46.0.1 → fixed in 1.46.0.1 - fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE CVE-2026-41586 CVSS 9.3 Critical
org.hyperledger.fabric-sdk-java:fabric-sdk-java>= 1.0.0, <= 2.2.26 → no fix listed - Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage CVE-2026-40860 CVSS 9.8 Critical
org.apache.camel:camel-jms>= 3.0.0, < 4.14.7 → fixed in 4.14.7;org.apache.camel:camel-jms>= 4.15.0, < 4.18.2 → fixed in 4.18.2;org.apache.camel:camel-jms>= 4.19.0, < 4.20.0 → fixed in 4.20.0; +15 more packages - Apache Camel has an incomplete fix for CVE-2025-27636 CVE-2026-40453 CVSS 9.9 Critical
org.apache.camel:camel-coap>= 3.0.0, < 4.14.6 → fixed in 4.14.6;org.apache.camel:camel-coap>= 4.15.0, < 4.18.2 → fixed in 4.18.2;org.apache.camel:camel-coap>= 4.19.0, < 4.20.0 → fixed in 4.20.0; +9 more packages - Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix) CVE-2026-41409 CVSS 9.8 Critical
org.apache.mina:mina-core>= 2.0.0, < 2.0.28 → fixed in 2.0.28;org.apache.mina:mina-core>= 2.1.0, < 2.1.11 → fixed in 2.1.11;org.apache.mina:mina-core>= 2.2.0, < 2.2.6 → fixed in 2.2.6