---
title: "Critical Maven advisories (page 2)"
url: https://erroneo.us/security/ecosystem/maven/2/
description: "All 334 critical GitHub-reviewed Maven security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 2 of 4."
type: ecosystem
section: "Security Digest"
date_modified: 2026-04-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Maven advisories (page 2)

- 2026-04-27 [CVE-2026-40976](https://erroneo.us/security/cve/CVE-2026-40976/index.md) Spring Boot's default security filter chain has no authorization rule with Actuator but without Health — org.springframework.boot:spring-boot >= 4.0.0, < 4.0.6 → 4.0.6
- 2026-04-27 [CVE-2026-41635](https://erroneo.us/security/cve/CVE-2026-41635/index.md) Apache MINA vulnerable to Deserialization of Untrusted Data — org.apache.mina:mina-core >= 2.0.0, < 2.0.28 → 2.0.28; org.apache.mina:mina-core >= 2.1.0, < 2.1.11 → 2.1.11; org.apache.mina:mina-core >= 2.2.0, < 2.2.6 → 2.2.6
- 2026-04-27 [CVE-2026-33453](https://erroneo.us/security/cve/CVE-2026-33453/index.md) Apache camel-coap allows header injection that can lead to remote code execution — org.apache.camel:camel-coap >= 4.14.0, <= 4.14.5 → 4.14.6; org.apache.camel:camel-coap >= 4.18.0, < 4.18.1 → 4.18.1
- 2026-04-27 [CVE-2026-33454](https://erroneo.us/security/cve/CVE-2026-33454/index.md) Apache Camel's Camel-Mail component is vulnerable to Camel message header injection — org.apache.camel:camel-mail >= 3.0.0, < 4.14.6 → 4.14.6; org.apache.camel:camel-mail >= 4.15.0, < 4.18.1 → 4.18.1
- 2026-04-21 [CVE-2026-32604](https://erroneo.us/security/cve/CVE-2026-32604/index.md) Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths — io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo < 2026.0.1 → 2026.0.1
- 2026-04-21 [CVE-2026-32613](https://erroneo.us/security/cve/CVE-2026-32613/index.md) Spinnaker: RCE via expression parsing due to unrestricted context handling — io.spinnaker.echo:echo-pipelinetriggers >= 2026.0-0, < 2026.0.1 → 2026.0.1; io.spinnaker.echo:echo-pipelinetriggers >= 2025.4-0, < 2025.4.2 → 2025.4.2; io.spinnaker.echo:echo-pipelinetriggers < 2025.3.2 → 2025.3.2
- 2026-04-20 [CVE-2026-33557](https://erroneo.us/security/cve/CVE-2026-33557/index.md) Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation — org.apache.kafka:kafka-clients >= 4.1.0, < 4.1.2 → 4.1.2
- 2026-04-17 [CVE-2025-14813](https://erroneo.us/security/cve/CVE-2025-14813/index.md) Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks — org.bouncycastle:bcprov-jdk14 >= 1.59, <= 1.80.1 → no fix; org.bouncycastle:bcprov-jdk15to18 >= 1.59, <= 1.80.1 → no fix; org.bouncycastle:bcprov-jdk18on >= 1.59, <= 1.80.1 → 1.80.2
- 2026-04-15 [CVE-2026-40478](https://erroneo.us/security/cve/CVE-2026-40478/index.md) Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf — org.thymeleaf:thymeleaf <= 3.1.3.RELEASE → 3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE → 3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE → 3.1.4.RELEASE
- 2026-04-15 [CVE-2026-40477](https://erroneo.us/security/cve/CVE-2026-40477/index.md) Improper restriction of the scope of accessible objects in Thymeleaf expressions — org.thymeleaf:thymeleaf <= 3.1.3.RELEASE → 3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring5 <= 3.1.3.RELEASE → 3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring6 <= 3.1.3.RELEASE → 3.1.4.RELEASE
- 2026-04-14 [CVE-2026-39842](https://erroneo.us/security/cve/CVE-2026-39842/index.md) Expression Injection in OpenRemote — io.openremote:openremote-manager <= 1.21.0 → 1.22.0
- 2026-04-09 [CVE-2026-29145](https://erroneo.us/security/cve/CVE-2026-29145/index.md) Apache Tomcat: CLIENT_CERT authentication does not fail as expected — org.apache.tomcat:tomcat >= 9.0.83, < 9.0.116 → 9.0.116; org.apache.tomcat:tomcat >= 10.1.0-M7, < 10.1.53 → 10.1.53; org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.20 → 11.0.20
- 2026-04-07 [CVE-2026-35580](https://erroneo.us/security/cve/CVE-2026-35580/index.md) Emissary has GitHub Actions Shell Injection via Workflow Inputs — gov.nsa.emissary:emissary < 8.39.0 → 8.39.0
- 2026-04-07 [CVE-2026-33439](https://erroneo.us/security/cve/CVE-2026-33439/index.md) OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM — org.openidentityplatform.openam:openam <= 16.0.5 → 16.0.6
- 2026-03-30 [CVE-2026-34361](https://erroneo.us/security/cve/CVE-2026-34361/index.md) FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft — ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4 → 6.9.4
- 2026-03-26 [GHSA-h8w2-rv57-vc6f](https://erroneo.us/security/ghsa/GHSA-h8w2-rv57-vc6f/index.md) splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution — com.splunk:splunk-otel-javaagent < 2.26.1 → 2.26.1
- 2026-03-26 [CVE-2026-22738](https://erroneo.us/security/cve/CVE-2026-22738/index.md) Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key — org.springframework.ai:spring-ai-vector-store >= 1.0.0, < 1.0.5 → 1.0.5; org.springframework.ai:spring-ai-vector-store >= 1.1.0-M1, < 1.1.4 → 1.1.4
- 2026-03-26 [CVE-2026-33728](https://erroneo.us/security/cve/CVE-2026-33728/index.md) dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution — com.datadoghq:dd-java-agent >= 0.40.0, < 1.60.3 → 1.60.3
- 2026-03-25 [CVE-2026-33701](https://erroneo.us/security/cve/CVE-2026-33701/index.md) OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution — io.opentelemetry.javaagent:opentelemetry-javaagent < 2.26.1 → 2.26.1
- 2026-03-19 [CVE-2026-22732](https://erroneo.us/security/cve/CVE-2026-22732/index.md) Spring Security HTTP Headers Are not Written Under Some Conditions — org.springframework.security:spring-security-web <= 5.7.14 → no fix; org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16 → no fix; org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10 → no fix
- 2026-03-18 [CVE-2026-33180](https://erroneo.us/security/cve/CVE-2026-33180/index.md) HAPI FHIR HTTP authentication leak in redirects — ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.0 → 6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.9.0 → 6.9.0; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.0 → 6.9.0
- 2026-03-16 [CVE-2026-25534](https://erroneo.us/security/cve/CVE-2026-25534/index.md) Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames — io.spinnaker.clouddriver:clouddriver-artifacts >= 2025.3.0, < 2025.3.1 → 2025.3.1; io.spinnaker.clouddriver:clouddriver-artifacts >= 2025.4.0, < 2025.4.1 → 2025.4.1; io.spinnaker.orca:orca-core >= 2025.3.0, < 2025.3.1 → 2025.3.1
- 2026-03-09 [CVE-2026-24015](https://erroneo.us/security/cve/CVE-2026-24015/index.md) Apache IoTDB has an Insecure Default Configuration Vulnerability — org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.7 → 1.3.7; org.apache.iotdb:iotdb-core >= 2.0.0, < 2.0.7 → 2.0.7
- 2026-03-09 [CVE-2026-24713](https://erroneo.us/security/cve/CVE-2026-24713/index.md) Apache IoTDB has an Improper Input Validation vulnerability — org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.7 → 1.3.7; org.apache.iotdb:iotdb-core >= 2.0.0, < 2.0.7 → 2.0.7
- 2026-03-04 [CVE-2026-29000](https://erroneo.us/security/cve/CVE-2026-29000/index.md) pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT — org.pac4j:pac4j-jwt >= 6.0.4.1, < 6.3.3 → 6.3.3; org.pac4j:pac4j-jwt >= 5.0.0-RC1, < 5.7.9 → 5.7.9; org.pac4j:pac4j-jwt < 4.5.9 → 4.5.9
- 2026-03-04 [CVE-2026-27446](https://erroneo.us/security/cve/CVE-2026-27446/index.md) Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions — org.apache.activemq:artemis-server >= 2.11.0, <= 2.44.0 → no fix; org.apache.artemis:artemis-server >= 2.50.0, < 2.52.0 → 2.52.0
- 2026-03-03 [CVE-2025-59059](https://erroneo.us/security/cve/CVE-2025-59059/index.md) Apache Ranger has a Code Injection vulnerability — org.apache.ranger:ranger-plugins-common < 2.8.0 → 2.8.0
- 2026-02-23 [CVE-2026-23552](https://erroneo.us/security/cve/CVE-2026-23552/index.md) Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm — org.apache.camel:camel-keycloak >= 4.15.0, < 4.18.0 → 4.18.0
- 2026-02-19 [CVE-2025-13590](https://erroneo.us/security/cve/CVE-2025-13590/index.md) carbon-apimgt does not properly restrict uploaded files — org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 < 9.32.167 → 9.32.167
- 2026-02-10 [CVE-2026-23906](https://erroneo.us/security/cve/CVE-2026-23906/index.md) Apache Druid Vulnerable to Authentication Bypass — org.apache.druid.extensions:druid-basic-security >= 0.17.0, < 36.0.0 → 36.0.0
- 2026-02-03 [CVE-2026-25526](https://erroneo.us/security/cve/CVE-2026-25526/index.md) JinJava Bypass through ForTag leads to Arbitrary Java Execution — com.hubspot.jinjava:jinjava >= 2.8.0, < 2.8.3 → 2.8.3; com.hubspot.jinjava:jinjava < 2.7.6 → 2.7.6
- 2026-02-02 [CVE-2024-5986](https://erroneo.us/security/cve/CVE-2024-5986/index.md) H2O has an External Control of File Name or Path vulnerability — ai.h2o:h2o-core <= 3.46.0.1 → no fix; h2o <= 3.46.0.1 → no fix
- 2026-01-26 [CVE-2016-15057](https://erroneo.us/security/cve/CVE-2016-15057/index.md) Apache Continuum vulnerable to Command Injection through Installations REST API — org.apache.continuum:continuum <= 1.4.2 → no fix
- 2026-01-20 [CVE-2025-64087](https://erroneo.us/security/cve/CVE-2025-64087/index.md) XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability — fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker < 2.2.0 → 2.2.0
- 2026-01-20 [CVE-2025-65482](https://erroneo.us/security/cve/CVE-2025-65482/index.md) XDocReport affected by an XML External Entity (XXE) vulnerability — fr.opensagres.xdocreport:fr.opensagres.xdocreport.document >= 0.9.2, < 2.0.4 → 2.0.4
- 2026-01-09 [CVE-2025-70974](https://erroneo.us/security/cve/CVE-2025-70974/index.md) FASTJSON Includes Functionality from Untrusted Control Sphere — com.alibaba:fastjson < 1.2.48 → 1.2.48
- 2026-01-09 [CVE-2025-65091](https://erroneo.us/security/cve/CVE-2025-65091/index.md) XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService — org.xwiki.contrib:macro-fullcalendar-pom <= 2.4.3 → 2.4.5
- 2026-01-07 [CVE-2025-12543](https://erroneo.us/security/cve/CVE-2025-12543/index.md) Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests — io.undertow:undertow-core = 2.4.0.Alpha1 → no fix; io.undertow:undertow-core >= 2.3.0.Alpha1, < 2.3.21.Final → 2.3.21.Final; io.undertow:undertow-core < 2.2.39.Final → 2.2.39.Final
- 2025-12-09 [CVE-2025-14306](https://erroneo.us/security/cve/CVE-2025-14306/index.md) Robocode vulnerable to Directory Traversal in recursivelyDelete Method — net.sf.robocode:robocode.core < 1.9.5.6 → 1.9.5.6
- 2025-12-09 [CVE-2025-14307](https://erroneo.us/security/cve/CVE-2025-14307/index.md) Robocode has an insecure temporary file creation vulnerability in the AutoExtract component — net.sf.robocode:robocode.battle < 1.9.5.6 → 1.9.5.6
- 2025-12-04 [CVE-2025-66516](https://erroneo.us/security/cve/CVE-2025-66516/index.md) Apache Tika has XXE vulnerability — org.apache.tika:tika-core >= 1.13, <= 3.2.1 → 3.2.2; org.apache.tika:tika-parsers >= 1.13, < 2.0.0 → 2.0.0; org.apache.tika:tika-parser-pdf-module >= 2.0.0, <= 3.2.1 → 3.2.2
- 2025-11-26 [CVE-2025-59390](https://erroneo.us/security/cve/CVE-2025-59390/index.md) Apache Druid’s Kerberos authenticator uses a weak fallback secret — org.apache.druid:druid < 35.0.0 → 35.0.0
- 2025-11-19 [CVE-2025-64408](https://erroneo.us/security/cve/CVE-2025-64408/index.md) Apache Causeway vulnerable to deserialization in Java — org.apache.causeway.commons:causeway-commons < 3.5.0 → 3.5.0; org.apache.causeway.core:causeway-applib < 3.5.0 → 3.5.0; org.apache.causeway.core:causeway-core < 3.5.0 → 3.5.0
- 2025-11-18 [CVE-2025-12383](https://erroneo.us/security/cve/CVE-2025-12383/index.md) Eclipse Jersey has a Race Condition — org.glassfish.jersey.core:jersey-client = 2.45 → 2.46; org.glassfish.jersey.core:jersey-client = 3.0.16 → 3.0.17; org.glassfish.jersey.core:jersey-client = 3.1.9 → 3.1.10
- 2025-10-17 [CVE-2025-56316](https://erroneo.us/security/cve/CVE-2025-56316/index.md) MCMS vulnerable SQL injection via the content_title parameter — net.mingsoft:ms-mcms >= 5.5.0, < 6.0.2 → 6.0.2
- 2025-10-06 [CVE-2025-52472](https://erroneo.us/security/cve/CVE-2025-52472/index.md) XWiki Platform is vulnerable to HQL injection via wiki and space search REST API — org.xwiki.platform:xwiki-platform-rest-server >= 17.0.0-rc-1, < 17.4.2 → 17.4.2; org.xwiki.platform:xwiki-platform-rest-server >= 4.3-milestone-1, < 16.10.9 → 16.10.9
- 2025-10-06 [CVE-2025-49594](https://erroneo.us/security/cve/CVE-2025-49594/index.md) XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view — org.xwiki.contrib.oidc:oidc-authenticator >= 2.17.1, < 2.18.2 → 2.18.2
- 2025-09-24 [CVE-2025-48459](https://erroneo.us/security/cve/CVE-2025-48459/index.md) Apache IoTDB: Deserialization of untrusted Data — org.apache.iotdb:iotdb-confignode >= 1.0.0, < 2.0.5 → 2.0.5; apache-iotdb >= 1.0.0, < 2.0.5 → 2.0.5
- 2025-09-22 [CVE-2025-6544](https://erroneo.us/security/cve/CVE-2025-6544/index.md) H2O affected by a deserialization vulnerability — ai.h2o:h2o-core <= 3.46.0.7 → no fix; h2o <= 3.46.0.7 → no fix
- 2025-09-17 [CVE-2025-59340](https://erroneo.us/security/cve/CVE-2025-59340/index.md) jinjava has Sandbox Bypass via JavaType-Based Deserialization — com.hubspot.jinjava:jinjava = 2.8.0 → 2.8.1; com.hubspot.jinjava:jinjava >= 2.7.0, < 2.7.5 → 2.7.5
- 2025-09-16 [CVE-2025-41243](https://erroneo.us/security/cve/CVE-2025-41243/index.md) Spring Expression language property modification using Spring Cloud Gateway Server WebFlux — org.springframework.cloud:spring-cloud-gateway-server-webflux >= 3.1.0, <= 3.1.10 → no fix; org.springframework.cloud:spring-cloud-gateway-server-webflux >= 4.0.0, <= 4.1.10 → no fix; org.springframework.cloud:spring-cloud-gateway-server-webflux >= 4.2.0, < 4.2.5 → 4.2.5
- 2025-09-03 [CVE-2025-55747](https://erroneo.us/security/cve/CVE-2025-55747/index.md) XWiki configuration files can be accessed through the webjars API — org.xwiki.platform:xwiki-platform-webjars-api >= 7.1.4, < 16.10.7 → 16.10.7; org.xwiki.platform:xwiki-platform-webjars-api >= 17.0.0-rc-1, < 17.4.0-rc-1 → 17.4.0-rc-1; org.xwiki.platform:xwiki-platform-webjars >= 6.1-miletone-2, <= 7.1.3 → no fix
- 2025-09-03 [CVE-2025-55748](https://erroneo.us/security/cve/CVE-2025-55748/index.md) XWiki configuration files can be accessed through jsx and sx endpoints — org.xwiki.platform:xwiki-platform-skin-skinx >= 4.2-milestone-2, < 16.10.7 → 16.10.7
- 2025-08-28 [CVE-2025-58059](https://erroneo.us/security/cve/CVE-2025-58059/index.md) Valtimo scripting engine can be used to gain access to sensitive data or resources — com.ritense.valtimo:core < 12.16.0.RELEASE → 12.16.0.RELEASE; com.ritense.valtimo:core >= 13.0.0.RELEASE, < 13.1.2.RELEASE → 13.1.2.RELEASE
- 2025-08-20 [CVE-2025-54988](https://erroneo.us/security/cve/CVE-2025-54988/index.md) Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF — org.apache.tika:tika-parser-pdf-module >= 1.13, < 3.2.2 → 3.2.2; org.apache.tika:tika-parsers >= 1.13, < 2.0.0-ALPHA → 2.0.0-ALPHA
- 2025-08-07 [CVE-2025-54951](https://erroneo.us/security/cve/CVE-2025-54951/index.md) ExecuTorch vulnerable to Heap-based Buffer Overflow — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-30404](https://erroneo.us/security/cve/CVE-2025-30404/index.md) ExecuTorch integer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-54950](https://erroneo.us/security/cve/CVE-2025-54950/index.md) ExecuTorch out-of-bounds access vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-54949](https://erroneo.us/security/cve/CVE-2025-54949/index.md) ExecuTorch heap buffer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-08-07 [CVE-2025-30405](https://erroneo.us/security/cve/CVE-2025-30405/index.md) ExecuTorch integer overflow vulnerability — executorch < 0.7.0 → 0.7.0; org.pytorch:executorch-android < 0.7.0 → 0.7.0; github.com/pytorch/executorch < 0.7.0 → 0.7.0
- 2025-07-24 [CVE-2025-32429](https://erroneo.us/security/cve/CVE-2025-32429/index.md) XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter — org.xwiki.platform:xwiki-platform-distribution-war >= 9.4-rc-1, < 16.10.6 → 16.10.6; org.xwiki.platform:xwiki-platform-distribution-war >= 17.0.0-rc-1, < 17.3.0-rc-1 → 17.3.0-rc-1
- 2025-07-14 [CVE-2025-53835](https://erroneo.us/security/cve/CVE-2025-53835/index.md) XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax — org.xwiki.rendering:xwiki-rendering-syntax-xhtml >= 5.4.5, < 14.10 → 14.10
- 2025-07-14 [CVE-2025-53836](https://erroneo.us/security/cve/CVE-2025-53836/index.md) XWiki Rendering is vulnerable to RCE attacks when processing nested macros — org.xwiki.rendering:xwiki-rendering-transformation-macro >= 4.2-milestone-1, < 13.10.11 → 13.10.11; org.xwiki.rendering:xwiki-rendering-transformation-macro >= 14.0, < 14.4.7 → 14.4.7; org.xwiki.rendering:xwiki-rendering-transformation-macro >= 14.5, < 14.10 → 14.10
- 2025-06-30 [CVE-2025-26074](https://erroneo.us/security/cve/CVE-2025-26074/index.md) Conductor vulnerable to OS command injection through unrestricted access to Java classes — org.conductoross:conductor-core < 3.21.13 → 3.21.13
- 2025-06-12 [CVE-2024-56158](https://erroneo.us/security/cve/CVE-2024-56158/index.md) XWiki allows SQL injection in query endpoint of REST API with Oracle — org.xwiki.platform:xwiki-platform-oldcore >= 1.0, < 15.10.16 → 15.10.16; org.xwiki.platform:xwiki-platform-oldcore >= 16.0.0-rc-1, < 16.4.7 → 16.4.7; org.xwiki.platform:xwiki-platform-oldcore >= 16.5.0-rc-1, < 16.10.2 → 16.10.2
- 2025-06-10 [CVE-2024-34711](https://erroneo.us/security/cve/CVE-2024-34711/index.md) GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) — org.geoserver.web:gs-web-app < 2.25.0 → 2.25.0; org.geoserver.main:gs-main < 2.25.0 → 2.25.0
- 2025-06-09 [GHSA-826p-4gcg-35vw](https://erroneo.us/security/ghsa/GHSA-826p-4gcg-35vw/index.md) GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling — org.geotools:gt-xsd-core = 33.0 → 33.1; org.geotools:gt-xsd-core >= 32.0, < 32.3 → 32.3; org.geotools:gt-xsd-core >= 29.0, <= 31.6 → 31.7
- 2025-05-21 [CVE-2025-41232](https://erroneo.us/security/cve/CVE-2025-41232/index.md) Spring Security authorization bypass for method security annotations on private methods — org.springframework.security:spring-security-aspects >= 6.4.0, < 6.4.6 → 6.4.6; org.springframework.security:spring-security-core >= 6.4.0, < 6.4.6 → 6.4.6
- 2025-05-14 [CVE-2025-47884](https://erroneo.us/security/cve/CVE-2025-47884/index.md) Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens — io.jenkins.plugins:oidc-provider < 111.v29fd614b3617 → 111.v29fd614b_3617
- 2025-05-14 [CVE-2025-4641](https://erroneo.us/security/cve/CVE-2025-4641/index.md) BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference — io.github.bonigarcia:webdrivermanager >= 1.0.0, < 6.1.0 → 6.1.0
- 2025-05-14 [CVE-2024-24780](https://erroneo.us/security/cve/CVE-2024-24780/index.md) Apache IoTDB Vulnerable to Remote Code Execution — org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.4 → 1.3.4; apache-iotdb >= 1.0.0, < 1.3.4 → 1.3.4
- 2025-05-05 [CVE-2025-45616](https://erroneo.us/security/cve/CVE-2025-45616/index.md) BRCC Incorrect Access Control vulnerability — com.baidu.mapp:brcc-core <= 1.2.0 → no fix
- 2025-05-05 [CVE-2025-2905](https://erroneo.us/security/cve/CVE-2025-2905/index.md) WSO2 API Manager XML External Entity (XXE) vulnerability — org.wso2.am:am-distribution-parent < 2.1.0 → 2.1.0
- 2025-04-30 [CVE-2025-46558](https://erroneo.us/security/cve/CVE-2025-46558/index.md) org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content — org.xwiki.contrib.markdown:syntax-markdown-commonmark12 >= 8.2, < 8.9 → 8.9
- 2025-04-29 [CVE-2025-32973](https://erroneo.us/security/cve/CVE-2025-32973/index.md) org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right — org.xwiki.platform:xwiki-platform-component-wiki >= 15.9-rc-1, < 15.10.12 → 15.10.12; org.xwiki.platform:xwiki-platform-component-wiki >= 16.0.0-rc-1, < 16.4.3 → 16.4.3; org.xwiki.platform:xwiki-platform-component-wiki >= 16.5.0-rc-1, < 16.8.0-rc-1 → 16.8.0-rc-1
- 2025-04-29 [CVE-2025-32974](https://erroneo.us/security/cve/CVE-2025-32974/index.md) org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type — org.xwiki.platform:xwiki-platform-security-requiredrights-default >= 15.9-rc-1, < 15.10.8 → 15.10.8; org.xwiki.platform:xwiki-platform-security-requiredrights-default >= 16.0.0-rc-1, < 16.2.0 → 16.2.0
- 2025-04-23 [CVE-2025-32969](https://erroneo.us/security/cve/CVE-2025-32969/index.md) org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API — org.xwiki.platform:xwiki-platform-rest-server >= 1.8, < 15.10.16 → 15.10.16; org.xwiki.platform:xwiki-platform-rest-server >= 16.0.0-rc-1, < 16.4.6 → 16.4.6; org.xwiki.platform:xwiki-platform-rest-server >= 16.5.0-rc-1, < 16.10.1 → 16.10.1
- 2025-04-21 [CVE-2025-29287](https://erroneo.us/security/cve/CVE-2025-29287/index.md) MCMS allows arbitrary file uploads in the ueditor component — net.mingsoft:ms-mcms < 5.4.4 → 5.4.4
- 2025-04-01 [CVE-2024-56325](https://erroneo.us/security/cve/CVE-2024-56325/index.md) Apache Pinot Vulnerable to Authentication Bypass — org.apache.pinot:pinot-broker >= 0.8.0, < 1.3.0 → 1.3.0; org.apache.pinot:pinot-common >= 0.8.0, < 1.3.0 → 1.3.0; org.apache.pinot:pinot-controller >= 0.8.0, < 1.3.0 → 1.3.0
- 2025-04-01 [CVE-2025-30065](https://erroneo.us/security/cve/CVE-2025-30065/index.md) Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution — org.apache.parquet:parquet-avro < 1.15.1 → 1.15.1
- 2025-03-24 [CVE-2025-29315](https://erroneo.us/security/cve/CVE-2025-29315/index.md) OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request — org.opendaylight.sfc:sfc-parent <= 0.10.4 → no fix
- 2025-03-20 [CVE-2024-10553](https://erroneo.us/security/cve/CVE-2024-10553/index.md) H2O Deserialization of Untrusted Data Vulnerability — h2o < 3.46.0.6 → 3.46.0.6; ai.h2o:h2o-core < 3.46.0.6 → 3.46.0.6
- 2025-03-10 [CVE-2025-24813](https://erroneo.us/security/cve/CVE-2025-24813/index.md) Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT — org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.3 → 11.0.3; org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.35 → 10.1.35; org.apache.tomcat:tomcat-catalina >= 9.0.0.M1, < 9.0.99 → 9.0.99
- 2025-03-07 [CVE-2025-27603](https://erroneo.us/security/cve/CVE-2025-27603/index.md) com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations — com.xwiki.confluencepro:application-confluence-migrator-pro-ui >= 1.0, < 1.2.0 → 1.2.0
- 2025-03-05 [CVE-2023-38693](https://erroneo.us/security/cve/CVE-2023-38693/index.md) Lucee RCE/XXE Vulnerability — org.lucee:lucee >= 5.3.10.79-RC, < 5.3.12.1 → 5.3.12.1; org.lucee:lucee >= 5.4.0.65-RC, < 5.4.3.2 → 5.4.3.2; org.lucee:lucee <= 5.3.7.59 → no fix
- 2025-02-20 [CVE-2025-24893](https://erroneo.us/security/cve/CVE-2025-24893/index.md) XWiki Platform allows remote code execution as guest via SolrSearchMacros request — org.xwiki.platform:xwiki-platform-search-solr-ui >= 5.3-milestone-2, < 15.10.11 → 15.10.11; org.xwiki.platform:xwiki-platform-search-solr-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1
- 2025-02-14 [CVE-2024-56180](https://erroneo.us/security/cve/CVE-2024-56180/index.md) Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution — org.apache.eventmesh:eventmesh-meta-raft >= 1.10.1, < 1.11.0 → 1.11.0
- 2025-02-14 [CVE-2024-52577](https://erroneo.us/security/cve/CVE-2024-52577/index.md) Apache Ignite: Possible RCE when deserializing incoming messages by the server node — org.apache.ignite:ignite-core >= 2.6.0, < 2.17.0 → 2.17.0
- 2025-02-05 [CVE-2024-36404](https://erroneo.us/security/cve/CVE-2024-36404/index.md) GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions — org.geotools:gt-app-schema >= 30.0, < 30.4 → 30.4; org.geotools:gt-complex >= 30.0, < 30.4 → 30.4; org.geotools.xsd:gt-xsd-core >= 30.0, < 30.4 → 30.4
- 2025-01-31 [CVE-2025-23215](https://erroneo.us/security/cve/CVE-2025-23215/index.md) PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext — net.sourceforge.pmd:pmd-designer >= 7.0.0, < 7.10.0 → 7.10.0; net.sourceforge.pmd:pmd-core >= 6.21.0, < 7.10.0 → 7.10.0; net.sourceforge.pmd:pmd-ui >= 6.14.0, <= 6.19.0 → no fix
- 2025-01-30 [GHSA-vpxm-cr3r-pjp9](https://erroneo.us/security/ghsa/GHSA-vpxm-cr3r-pjp9/index.md) General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches — org.openmrs:openmrs < 2.6.11 → 2.6.11; org.openmrs.module:legacyui < 1.21.0 → 1.21.0; org.openmrs.module:idgen < 4.14.0 → 4.14.0
- 2025-01-29 [CVE-2025-0851](https://erroneo.us/security/cve/CVE-2025-0851/index.md) Deep Java Library path traversal issue — ai.djl:api < 0.31.1 → 0.31.1
- 2025-01-21 [CVE-2024-45479](https://erroneo.us/security/cve/CVE-2024-45479/index.md) Apache Ranger UI vulnerable to Server Side Request Forgery — org.apache.ranger:ranger >= 0.5.0, < 2.5.0 → 2.5.0
- 2025-01-14 [CVE-2025-23025](https://erroneo.us/security/cve/CVE-2025-23025/index.md) XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing — org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 13.9-rc-1, < 15.10.12 → 15.10.12; org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 16.0.0-rc-1, < 16.4.1 → 16.4.1; org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui >= 16.5.0-rc-1, < 16.6.0-rc-1 → 16.6.0-rc-1
- 2025-01-08 [CVE-2024-54676](https://erroneo.us/security/cve/CVE-2024-54676/index.md) Apache OpenMeetings vulnerable to Deserialization of Untrusted Data — org.apache.openmeetings:openmeetings-parent >= 2.1.0, < 8.0.0 → 8.0.0
- 2024-12-25 [CVE-2024-52046](https://erroneo.us/security/cve/CVE-2024-52046/index.md) Apache MINA Deserialization RCE Vulnerability — org.apache.mina:mina-core >= 2.2.0, < 2.2.4 → 2.2.4; org.apache.mina:mina-core >= 2.1.0, < 2.1.10 → 2.1.10; org.apache.mina:mina-core >= 2.0.0-M1, < 2.0.27 → 2.0.27
- 2024-12-24 [CVE-2024-43441](https://erroneo.us/security/cve/CVE-2024-43441/index.md) Apache HugeGraph-Server: Fixed JWT Token (Secret) — org.apache.hugegraph:hugegraph-server >= 1.0.0, < 1.5.0 → 1.5.0
- 2024-12-12 [CVE-2024-55879](https://erroneo.us/security/cve/CVE-2024-55879/index.md) XWiki allows RCE from script right in configurable sections — org.xwiki.platform:xwiki-platform-administration-ui >= 2.3, < 15.10.9 → 15.10.9; org.xwiki.platform:xwiki-platform-administration-ui >= 16.0.0-rc-1, < 16.3.0 → 16.3.0
- 2024-12-12 [CVE-2024-55662](https://erroneo.us/security/cve/CVE-2024-55662/index.md) XWiki allows remote code execution through the extension sheet — org.xwiki.platform:xwiki-platform-repository-server-ui >= 3.3-milestone-1, < 15.10.9 → 15.10.9; org.xwiki.platform:xwiki-platform-repository-server-ui >= 16.0.0-rc-1, < 16.3.0 → 16.3.0
- 2024-12-12 [CVE-2024-55875](https://erroneo.us/security/cve/CVE-2024-55875/index.md) http4k has a potential XXE (XML External Entity Injection) vulnerability — org.http4k:http4k-format-xml < 6.50.0.0 → 6.50.0.0

Pages: https://erroneo.us/security/ecosystem/maven/index.md · https://erroneo.us/security/ecosystem/maven/2/index.md · https://erroneo.us/security/ecosystem/maven/3/index.md · https://erroneo.us/security/ecosystem/maven/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/maven/2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt