Security Digest · page 2 of 4
Critical Maven advisories (page 2)
334 critical advisories for Maven packages since October 2023, newest first. Check your project with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
- Spring Boot's default security filter chain has no authorization rule with Actuator but without Health CVE-2026-40976 CVSS 9.1 Critical
org.springframework.boot:spring-boot>= 4.0.0, < 4.0.6 → fixed in 4.0.6 - Apache MINA vulnerable to Deserialization of Untrusted Data CVE-2026-41635 CVSS 9.8 Critical
org.apache.mina:mina-core>= 2.0.0, < 2.0.28 → fixed in 2.0.28;org.apache.mina:mina-core>= 2.1.0, < 2.1.11 → fixed in 2.1.11;org.apache.mina:mina-core>= 2.2.0, < 2.2.6 → fixed in 2.2.6 - Apache camel-coap allows header injection that can lead to remote code execution CVE-2026-33453 CVSS 10.0 Critical
org.apache.camel:camel-coap>= 4.14.0, <= 4.14.5 → fixed in 4.14.6;org.apache.camel:camel-coap>= 4.18.0, < 4.18.1 → fixed in 4.18.1 - Apache Camel's Camel-Mail component is vulnerable to Camel message header injection CVE-2026-33454 CVSS 9.4 Critical
org.apache.camel:camel-mail>= 3.0.0, < 4.14.6 → fixed in 4.14.6;org.apache.camel:camel-mail>= 4.15.0, < 4.18.1 → fixed in 4.18.1 - Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths CVE-2026-32604 CVSS 9.9 Critical
io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo< 2026.0.1 → fixed in 2026.0.1 - Spinnaker: RCE via expression parsing due to unrestricted context handling CVE-2026-32613 CVSS 9.9 Critical
io.spinnaker.echo:echo-pipelinetriggers>= 2026.0-0, < 2026.0.1 → fixed in 2026.0.1;io.spinnaker.echo:echo-pipelinetriggers>= 2025.4-0, < 2025.4.2 → fixed in 2025.4.2;io.spinnaker.echo:echo-pipelinetriggers< 2025.3.2 → fixed in 2025.3.2 - Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation CVE-2026-33557 CVSS 9.1 Critical
org.apache.kafka:kafka-clients>= 4.1.0, < 4.1.2 → fixed in 4.1.2 - Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks CVE-2025-14813 CVSS 9.3 Critical
org.bouncycastle:bcprov-jdk14>= 1.59, <= 1.80.1 → no fix listed;org.bouncycastle:bcprov-jdk15to18>= 1.59, <= 1.80.1 → no fix listed;org.bouncycastle:bcprov-jdk18on>= 1.59, <= 1.80.1 → fixed in 1.80.2; +23 more packages - Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVE-2026-40478 CVSS 9.0 Critical
org.thymeleaf:thymeleaf<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring5<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring6<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE - Improper restriction of the scope of accessible objects in Thymeleaf expressions CVE-2026-40477 CVSS 9.0 Critical
org.thymeleaf:thymeleaf<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring5<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE;org.thymeleaf:thymeleaf-spring6<= 3.1.3.RELEASE → fixed in 3.1.4.RELEASE - Expression Injection in OpenRemote CVE-2026-39842 CVSS 9.9 Critical
io.openremote:openremote-manager<= 1.21.0 → fixed in 1.22.0 - Apache Tomcat: CLIENT_CERT authentication does not fail as expected CVE-2026-29145 CVSS 9.1 Critical
org.apache.tomcat:tomcat>= 9.0.83, < 9.0.116 → fixed in 9.0.116;org.apache.tomcat:tomcat>= 10.1.0-M7, < 10.1.53 → fixed in 10.1.53;org.apache.tomcat:tomcat>= 11.0.0-M1, < 11.0.20 → fixed in 11.0.20; +3 more packages - Emissary has GitHub Actions Shell Injection via Workflow Inputs CVE-2026-35580 CVSS 9.1 Critical
gov.nsa.emissary:emissary< 8.39.0 → fixed in 8.39.0 - OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVE-2026-33439 CVSS 9.3 Critical
org.openidentityplatform.openam:openam<= 16.0.5 → fixed in 16.0.6 - FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft CVE-2026-34361 CVSS 9.3 Critical
ca.uhn.hapi.fhir:org.hl7.fhir.validation< 6.9.4 → fixed in 6.9.4 - splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution GHSA-h8w2-rv57-vc6f CVSS 9.3 Critical
com.splunk:splunk-otel-javaagent< 2.26.1 → fixed in 2.26.1 - Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key CVE-2026-22738 CVSS 9.8 Critical
org.springframework.ai:spring-ai-vector-store>= 1.0.0, < 1.0.5 → fixed in 1.0.5;org.springframework.ai:spring-ai-vector-store>= 1.1.0-M1, < 1.1.4 → fixed in 1.1.4 - dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution CVE-2026-33728 CVSS 9.3 Critical
com.datadoghq:dd-java-agent>= 0.40.0, < 1.60.3 → fixed in 1.60.3 - OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution CVE-2026-33701 CVSS 9.3 Critical
io.opentelemetry.javaagent:opentelemetry-javaagent< 2.26.1 → fixed in 2.26.1 - Spring Security HTTP Headers Are not Written Under Some Conditions CVE-2026-22732 CVSS 9.1 Critical
org.springframework.security:spring-security-web<= 5.7.14 → no fix listed;org.springframework.security:spring-security-web>= 5.8.0, <= 5.8.16 → no fix listed;org.springframework.security:spring-security-web>= 6.0.0, <= 6.3.10 → no fix listed; +3 more packages - HAPI FHIR HTTP authentication leak in redirects CVE-2026-33180 CVSS 9.8 Critical
ca.uhn.hapi.fhir:org.hl7.fhir.utilities< 6.9.0 → fixed in 6.9.0;ca.uhn.hapi.fhir:org.hl7.fhir.convertors< 6.9.0 → fixed in 6.9.0;ca.uhn.hapi.fhir:org.hl7.fhir.dstu2< 6.9.0 → fixed in 6.9.0; +9 more packages - Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames CVE-2026-25534 CVSS 9.1 Critical
io.spinnaker.clouddriver:clouddriver-artifacts>= 2025.3.0, < 2025.3.1 → fixed in 2025.3.1;io.spinnaker.clouddriver:clouddriver-artifacts>= 2025.4.0, < 2025.4.1 → fixed in 2025.4.1;io.spinnaker.orca:orca-core>= 2025.3.0, < 2025.3.1 → fixed in 2025.3.1; +3 more packages - Apache IoTDB has an Insecure Default Configuration Vulnerability CVE-2026-24015 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.7 → fixed in 1.3.7;org.apache.iotdb:iotdb-core>= 2.0.0, < 2.0.7 → fixed in 2.0.7 - Apache IoTDB has an Improper Input Validation vulnerability CVE-2026-24713 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.7 → fixed in 1.3.7;org.apache.iotdb:iotdb-core>= 2.0.0, < 2.0.7 → fixed in 2.0.7 - pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT CVE-2026-29000 CVSS 10.0 Critical
org.pac4j:pac4j-jwt>= 6.0.4.1, < 6.3.3 → fixed in 6.3.3;org.pac4j:pac4j-jwt>= 5.0.0-RC1, < 5.7.9 → fixed in 5.7.9;org.pac4j:pac4j-jwt< 4.5.9 → fixed in 4.5.9 - Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions CVE-2026-27446 CVSS 9.3 Critical
org.apache.activemq:artemis-server>= 2.11.0, <= 2.44.0 → no fix listed;org.apache.artemis:artemis-server>= 2.50.0, < 2.52.0 → fixed in 2.52.0 - Apache Ranger has a Code Injection vulnerability CVE-2025-59059 CVSS 9.8 Critical
org.apache.ranger:ranger-plugins-common< 2.8.0 → fixed in 2.8.0 - Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm CVE-2026-23552 CVSS 9.1 Critical
org.apache.camel:camel-keycloak>= 4.15.0, < 4.18.0 → fixed in 4.18.0 - carbon-apimgt does not properly restrict uploaded files CVE-2025-13590 CVSS 9.1 Critical
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1< 9.32.167 → fixed in 9.32.167 - Apache Druid Vulnerable to Authentication Bypass CVE-2026-23906 CVSS 9.3 Critical
org.apache.druid.extensions:druid-basic-security>= 0.17.0, < 36.0.0 → fixed in 36.0.0 - JinJava Bypass through ForTag leads to Arbitrary Java Execution CVE-2026-25526 CVSS 9.8 Critical
com.hubspot.jinjava:jinjava>= 2.8.0, < 2.8.3 → fixed in 2.8.3;com.hubspot.jinjava:jinjava< 2.7.6 → fixed in 2.7.6 - H2O has an External Control of File Name or Path vulnerability CVE-2024-5986 CVSS 9.1 Critical
ai.h2o:h2o-core<= 3.46.0.1 → no fix listed;h2o<= 3.46.0.1 → no fix listed - Apache Continuum vulnerable to Command Injection through Installations REST API CVE-2016-15057 CVSS 9.9 Critical
org.apache.continuum:continuum<= 1.4.2 → no fix listed - XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability CVE-2025-64087 CVSS 9.8 Critical
fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker< 2.2.0 → fixed in 2.2.0 - XDocReport affected by an XML External Entity (XXE) vulnerability CVE-2025-65482 CVSS 9.8 Critical
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document>= 0.9.2, < 2.0.4 → fixed in 2.0.4 - FASTJSON Includes Functionality from Untrusted Control Sphere CVE-2025-70974 CVSS 10.0 Critical
com.alibaba:fastjson< 1.2.48 → fixed in 1.2.48 - XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService CVE-2025-65091 CVSS 10.0 Critical
org.xwiki.contrib:macro-fullcalendar-pom<= 2.4.3 → fixed in 2.4.5 - Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests CVE-2025-12543 CVSS 9.6 Critical
io.undertow:undertow-core= 2.4.0.Alpha1 → no fix listed;io.undertow:undertow-core>= 2.3.0.Alpha1, < 2.3.21.Final → fixed in 2.3.21.Final;io.undertow:undertow-core< 2.2.39.Final → fixed in 2.2.39.Final - Robocode vulnerable to Directory Traversal in recursivelyDelete Method CVE-2025-14306 CVSS 10.0 Critical
net.sf.robocode:robocode.core< 1.9.5.6 → fixed in 1.9.5.6 - Robocode has an insecure temporary file creation vulnerability in the AutoExtract component CVE-2025-14307 CVSS 9.3 Critical
net.sf.robocode:robocode.battle< 1.9.5.6 → fixed in 1.9.5.6 - Apache Tika has XXE vulnerability CVE-2025-66516 CVSS 10.0 Critical
org.apache.tika:tika-core>= 1.13, <= 3.2.1 → fixed in 3.2.2;org.apache.tika:tika-parsers>= 1.13, < 2.0.0 → fixed in 2.0.0;org.apache.tika:tika-parser-pdf-module>= 2.0.0, <= 3.2.1 → fixed in 3.2.2 - Apache Druid’s Kerberos authenticator uses a weak fallback secret CVE-2025-59390 CVSS 9.8 Critical
org.apache.druid:druid< 35.0.0 → fixed in 35.0.0 - Apache Causeway vulnerable to deserialization in Java CVE-2025-64408 CVSS 9.3 Critical
org.apache.causeway.commons:causeway-commons< 3.5.0 → fixed in 3.5.0;org.apache.causeway.core:causeway-applib< 3.5.0 → fixed in 3.5.0;org.apache.causeway.core:causeway-core< 3.5.0 → fixed in 3.5.0; +1 more packages - Eclipse Jersey has a Race Condition CVE-2025-12383 CVSS 9.4 Critical
org.glassfish.jersey.core:jersey-client= 2.45 → fixed in 2.46;org.glassfish.jersey.core:jersey-client= 3.0.16 → fixed in 3.0.17;org.glassfish.jersey.core:jersey-client= 3.1.9 → fixed in 3.1.10 - MCMS vulnerable SQL injection via the content_title parameter CVE-2025-56316 CVSS 9.8 Critical
net.mingsoft:ms-mcms>= 5.5.0, < 6.0.2 → fixed in 6.0.2 - XWiki Platform is vulnerable to HQL injection via wiki and space search REST API CVE-2025-52472 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-rest-server>= 17.0.0-rc-1, < 17.4.2 → fixed in 17.4.2;org.xwiki.platform:xwiki-platform-rest-server>= 4.3-milestone-1, < 16.10.9 → fixed in 16.10.9 - XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view CVE-2025-49594 CVSS 9.2 Critical
org.xwiki.contrib.oidc:oidc-authenticator>= 2.17.1, < 2.18.2 → fixed in 2.18.2 - Apache IoTDB: Deserialization of untrusted Data CVE-2025-48459 CVSS 9.3 Critical
org.apache.iotdb:iotdb-confignode>= 1.0.0, < 2.0.5 → fixed in 2.0.5;apache-iotdb>= 1.0.0, < 2.0.5 → fixed in 2.0.5 - H2O affected by a deserialization vulnerability CVE-2025-6544 CVSS 9.8 Critical
ai.h2o:h2o-core<= 3.46.0.7 → no fix listed;h2o<= 3.46.0.7 → no fix listed - jinjava has Sandbox Bypass via JavaType-Based Deserialization CVE-2025-59340 CVSS 9.8 Critical
com.hubspot.jinjava:jinjava= 2.8.0 → fixed in 2.8.1;com.hubspot.jinjava:jinjava>= 2.7.0, < 2.7.5 → fixed in 2.7.5 - Spring Expression language property modification using Spring Cloud Gateway Server WebFlux CVE-2025-41243 CVSS 10.0 Critical
org.springframework.cloud:spring-cloud-gateway-server-webflux>= 3.1.0, <= 3.1.10 → no fix listed;org.springframework.cloud:spring-cloud-gateway-server-webflux>= 4.0.0, <= 4.1.10 → no fix listed;org.springframework.cloud:spring-cloud-gateway-server-webflux>= 4.2.0, < 4.2.5 → fixed in 4.2.5; +1 more packages - XWiki configuration files can be accessed through the webjars API CVE-2025-55747 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-webjars-api>= 7.1.4, < 16.10.7 → fixed in 16.10.7;org.xwiki.platform:xwiki-platform-webjars-api>= 17.0.0-rc-1, < 17.4.0-rc-1 → fixed in 17.4.0-rc-1;org.xwiki.platform:xwiki-platform-webjars>= 6.1-miletone-2, <= 7.1.3 → no fix listed - XWiki configuration files can be accessed through jsx and sx endpoints CVE-2025-55748 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-skin-skinx>= 4.2-milestone-2, < 16.10.7 → fixed in 16.10.7 - Valtimo scripting engine can be used to gain access to sensitive data or resources CVE-2025-58059 CVSS 9.1 Critical
com.ritense.valtimo:core< 12.16.0.RELEASE → fixed in 12.16.0.RELEASE;com.ritense.valtimo:core>= 13.0.0.RELEASE, < 13.1.2.RELEASE → fixed in 13.1.2.RELEASE - Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF CVE-2025-54988 CVSS 9.3 Critical
org.apache.tika:tika-parser-pdf-module>= 1.13, < 3.2.2 → fixed in 3.2.2;org.apache.tika:tika-parsers>= 1.13, < 2.0.0-ALPHA → fixed in 2.0.0-ALPHA - ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter CVE-2025-32429 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-distribution-war>= 9.4-rc-1, < 16.10.6 → fixed in 16.10.6;org.xwiki.platform:xwiki-platform-distribution-war>= 17.0.0-rc-1, < 17.3.0-rc-1 → fixed in 17.3.0-rc-1 - XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax CVE-2025-53835 CVSS 9.0 Critical
org.xwiki.rendering:xwiki-rendering-syntax-xhtml>= 5.4.5, < 14.10 → fixed in 14.10 - XWiki Rendering is vulnerable to RCE attacks when processing nested macros CVE-2025-53836 CVSS 9.9 Critical
org.xwiki.rendering:xwiki-rendering-transformation-macro>= 4.2-milestone-1, < 13.10.11 → fixed in 13.10.11;org.xwiki.rendering:xwiki-rendering-transformation-macro>= 14.0, < 14.4.7 → fixed in 14.4.7;org.xwiki.rendering:xwiki-rendering-transformation-macro>= 14.5, < 14.10 → fixed in 14.10 - Conductor vulnerable to OS command injection through unrestricted access to Java classes CVE-2025-26074 CVSS 9.8 Critical
org.conductoross:conductor-core< 3.21.13 → fixed in 3.21.13 - XWiki allows SQL injection in query endpoint of REST API with Oracle CVE-2024-56158 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-oldcore>= 1.0, < 15.10.16 → fixed in 15.10.16;org.xwiki.platform:xwiki-platform-oldcore>= 16.0.0-rc-1, < 16.4.7 → fixed in 16.4.7;org.xwiki.platform:xwiki-platform-oldcore>= 16.5.0-rc-1, < 16.10.2 → fixed in 16.10.2 - GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) CVE-2024-34711 CVSS 9.3 Critical
org.geoserver.web:gs-web-app< 2.25.0 → fixed in 2.25.0;org.geoserver.main:gs-main< 2.25.0 → fixed in 2.25.0 - GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling GHSA-826p-4gcg-35vw CVSS 9.9 Critical
org.geotools:gt-xsd-core= 33.0 → fixed in 33.1;org.geotools:gt-xsd-core>= 32.0, < 32.3 → fixed in 32.3;org.geotools:gt-xsd-core>= 29.0, <= 31.6 → fixed in 31.7; +5 more packages - Spring Security authorization bypass for method security annotations on private methods CVE-2025-41232 CVSS 9.1 Critical
org.springframework.security:spring-security-aspects>= 6.4.0, < 6.4.6 → fixed in 6.4.6;org.springframework.security:spring-security-core>= 6.4.0, < 6.4.6 → fixed in 6.4.6 - Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens CVE-2025-47884 CVSS 9.1 Critical
io.jenkins.plugins:oidc-provider< 111.v29fd614b3617 → fixed in 111.v29fd614b_3617 - BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference CVE-2025-4641 CVSS 9.3 Critical
io.github.bonigarcia:webdrivermanager>= 1.0.0, < 6.1.0 → fixed in 6.1.0 - Apache IoTDB Vulnerable to Remote Code Execution CVE-2024-24780 CVSS 9.8 Critical
org.apache.iotdb:iotdb-core>= 1.0.0, < 1.3.4 → fixed in 1.3.4;apache-iotdb>= 1.0.0, < 1.3.4 → fixed in 1.3.4 - BRCC Incorrect Access Control vulnerability CVE-2025-45616 CVSS 9.8 Critical
com.baidu.mapp:brcc-core<= 1.2.0 → no fix listed - WSO2 API Manager XML External Entity (XXE) vulnerability CVE-2025-2905 CVSS 9.1 Critical
org.wso2.am:am-distribution-parent< 2.1.0 → fixed in 2.1.0 - org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content CVE-2025-46558 CVSS 9.0 Critical
org.xwiki.contrib.markdown:syntax-markdown-commonmark12>= 8.2, < 8.9 → fixed in 8.9 - org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right CVE-2025-32973 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-component-wiki>= 15.9-rc-1, < 15.10.12 → fixed in 15.10.12;org.xwiki.platform:xwiki-platform-component-wiki>= 16.0.0-rc-1, < 16.4.3 → fixed in 16.4.3;org.xwiki.platform:xwiki-platform-component-wiki>= 16.5.0-rc-1, < 16.8.0-rc-1 → fixed in 16.8.0-rc-1 - org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content… CVE-2025-32974 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-security-requiredrights-default>= 15.9-rc-1, < 15.10.8 → fixed in 15.10.8;org.xwiki.platform:xwiki-platform-security-requiredrights-default>= 16.0.0-rc-1, < 16.2.0 → fixed in 16.2.0 - org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVE-2025-32969 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-rest-server>= 1.8, < 15.10.16 → fixed in 15.10.16;org.xwiki.platform:xwiki-platform-rest-server>= 16.0.0-rc-1, < 16.4.6 → fixed in 16.4.6;org.xwiki.platform:xwiki-platform-rest-server>= 16.5.0-rc-1, < 16.10.1 → fixed in 16.10.1 - MCMS allows arbitrary file uploads in the ueditor component CVE-2025-29287 CVSS 9.8 Critical
net.mingsoft:ms-mcms< 5.4.4 → fixed in 5.4.4 - Apache Pinot Vulnerable to Authentication Bypass CVE-2024-56325 CVSS 9.3 Critical
org.apache.pinot:pinot-broker>= 0.8.0, < 1.3.0 → fixed in 1.3.0;org.apache.pinot:pinot-common>= 0.8.0, < 1.3.0 → fixed in 1.3.0;org.apache.pinot:pinot-controller>= 0.8.0, < 1.3.0 → fixed in 1.3.0 - Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution CVE-2025-30065 CVSS 10.0 Critical
org.apache.parquet:parquet-avro< 1.15.1 → fixed in 1.15.1 - OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request CVE-2025-29315 CVSS 9.8 Critical
org.opendaylight.sfc:sfc-parent<= 0.10.4 → no fix listed - H2O Deserialization of Untrusted Data Vulnerability CVE-2024-10553 CVSS 9.8 Critical
h2o< 3.46.0.6 → fixed in 3.46.0.6;ai.h2o:h2o-core< 3.46.0.6 → fixed in 3.46.0.6 - Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2025-24813 CVSS 9.2 Critical
org.apache.tomcat:tomcat-catalina>= 11.0.0-M1, < 11.0.3 → fixed in 11.0.3;org.apache.tomcat:tomcat-catalina>= 10.1.0-M1, < 10.1.35 → fixed in 10.1.35;org.apache.tomcat:tomcat-catalina>= 9.0.0.M1, < 9.0.99 → fixed in 9.0.99; +5 more packages - com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations CVE-2025-27603 CVSS 9.1 Critical
com.xwiki.confluencepro:application-confluence-migrator-pro-ui>= 1.0, < 1.2.0 → fixed in 1.2.0 - Lucee RCE/XXE Vulnerability CVE-2023-38693 CVSS 10.0 Critical
org.lucee:lucee>= 5.3.10.79-RC, < 5.3.12.1 → fixed in 5.3.12.1;org.lucee:lucee>= 5.4.0.65-RC, < 5.4.3.2 → fixed in 5.4.3.2;org.lucee:lucee<= 5.3.7.59 → no fix listed; +2 more packages - XWiki Platform allows remote code execution as guest via SolrSearchMacros request CVE-2025-24893 CVSS 9.8 Critical
org.xwiki.platform:xwiki-platform-search-solr-ui>= 5.3-milestone-2, < 15.10.11 → fixed in 15.10.11;org.xwiki.platform:xwiki-platform-search-solr-ui>= 16.0.0-rc-1, < 16.4.1 → fixed in 16.4.1 - Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution CVE-2024-56180 CVSS 9.8 Critical
org.apache.eventmesh:eventmesh-meta-raft>= 1.10.1, < 1.11.0 → fixed in 1.11.0 - Apache Ignite: Possible RCE when deserializing incoming messages by the server node CVE-2024-52577 CVSS 9.5 Critical
org.apache.ignite:ignite-core>= 2.6.0, < 2.17.0 → fixed in 2.17.0 - GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions CVE-2024-36404 CVSS 9.8 Critical
org.geotools:gt-app-schema>= 30.0, < 30.4 → fixed in 30.4;org.geotools:gt-complex>= 30.0, < 30.4 → fixed in 30.4;org.geotools.xsd:gt-xsd-core>= 30.0, < 30.4 → fixed in 30.4; +9 more packages - PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext CVE-2025-23215 CVSS 9.3 Critical
net.sourceforge.pmd:pmd-designer>= 7.0.0, < 7.10.0 → fixed in 7.10.0;net.sourceforge.pmd:pmd-core>= 6.21.0, < 7.10.0 → fixed in 7.10.0;net.sourceforge.pmd:pmd-ui>= 6.14.0, <= 6.19.0 → no fix listed - General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches GHSA-vpxm-cr3r-pjp9
org.openmrs:openmrs< 2.6.11 → fixed in 2.6.11;org.openmrs.module:legacyui< 1.21.0 → fixed in 1.21.0;org.openmrs.module:idgen< 4.14.0 → fixed in 4.14.0; +3 more packages - Deep Java Library path traversal issue CVE-2025-0851 CVSS 9.3 Critical
ai.djl:api< 0.31.1 → fixed in 0.31.1 - Apache Ranger UI vulnerable to Server Side Request Forgery CVE-2024-45479 CVSS 9.1 Critical
org.apache.ranger:ranger>= 0.5.0, < 2.5.0 → fixed in 2.5.0 - XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing CVE-2025-23025 CVSS 9.0 Critical
org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui>= 13.9-rc-1, < 15.10.12 → fixed in 15.10.12;org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui>= 16.0.0-rc-1, < 16.4.1 → fixed in 16.4.1;org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui>= 16.5.0-rc-1, < 16.6.0-rc-1 → fixed in 16.6.0-rc-1 - Apache OpenMeetings vulnerable to Deserialization of Untrusted Data CVE-2024-54676 CVSS 9.3 Critical
org.apache.openmeetings:openmeetings-parent>= 2.1.0, < 8.0.0 → fixed in 8.0.0 - Apache MINA Deserialization RCE Vulnerability CVE-2024-52046 CVSS 10.0 Critical
org.apache.mina:mina-core>= 2.2.0, < 2.2.4 → fixed in 2.2.4;org.apache.mina:mina-core>= 2.1.0, < 2.1.10 → fixed in 2.1.10;org.apache.mina:mina-core>= 2.0.0-M1, < 2.0.27 → fixed in 2.0.27 - Apache HugeGraph-Server: Fixed JWT Token (Secret) CVE-2024-43441 CVSS 9.8 Critical
org.apache.hugegraph:hugegraph-server>= 1.0.0, < 1.5.0 → fixed in 1.5.0 - XWiki allows RCE from script right in configurable sections CVE-2024-55879 CVSS 9.1 Critical
org.xwiki.platform:xwiki-platform-administration-ui>= 2.3, < 15.10.9 → fixed in 15.10.9;org.xwiki.platform:xwiki-platform-administration-ui>= 16.0.0-rc-1, < 16.3.0 → fixed in 16.3.0 - XWiki allows remote code execution through the extension sheet CVE-2024-55662 CVSS 9.9 Critical
org.xwiki.platform:xwiki-platform-repository-server-ui>= 3.3-milestone-1, < 15.10.9 → fixed in 15.10.9;org.xwiki.platform:xwiki-platform-repository-server-ui>= 16.0.0-rc-1, < 16.3.0 → fixed in 16.3.0 - http4k has a potential XXE (XML External Entity Injection) vulnerability CVE-2024-55875 CVSS 9.8 Critical
org.http4k:http4k-format-xml< 6.50.0.0 → fixed in 6.50.0.0