---
title: "Critical Maven advisories"
url: https://erroneo.us/security/ecosystem/maven/
description: "All 334 critical GitHub-reviewed Maven security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-10-08
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical Maven advisories

- 2026-10-08 [CVE-2026-107282](https://erroneo.us/security/cve/CVE-2026-107282/index.md) AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host — org.asynchttpclient:async-http-client >= 3.0.0, <= 3.0.12 → 3.0.13; org.asynchttpclient:async-http-client >= 2.0.0, <= 2.16.0 → 2.16.1
- 2026-10-08 [CVE-2026-107726](https://erroneo.us/security/cve/CVE-2026-107726/index.md) Hazelcast allows arbitrary member memory access by low-privileged client — com.hazelcast:hazelcast = 5.6.0 → 5.7.0; com.hazelcast:hazelcast >= 5.5.0, < 5.5.10 → 5.7.0; com.hazelcast:hazelcast < 5.4.5 → 5.7.0
- 2026-10-05 [CVE-2026-103922](https://erroneo.us/security/cve/CVE-2026-103922/index.md) Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path — @capacitor/android >= 6.0.0, < 6.2.2 → 6.2.2; @capacitor/android >= 7.0.0, < 7.6.9 → 7.6.9; @capacitor/ios >= 6.0.0, < 6.2.2 → 6.2.2
- 2026-09-24 [CVE-2026-61741](https://erroneo.us/security/cve/CVE-2026-61741/index.md) http4s-scala-xml has an XML External Entity (XXE) processing issue — org.http4s:http4s-scala-xml_2.12 <= 0.24.0 → 0.24.1; org.http4s:http4s-scala-xml_2.13 <= 0.24.0 → 0.24.1; org.http4s:http4s-scala-xml_2.13 >= 1.0.0-M1, <= 1.0.0-M38.1 → 1.0.0-M39
- 2026-09-23 [CVE-2026-85724](https://erroneo.us/security/cve/CVE-2026-85724/index.md) Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug — io.moquette:moquette-broker <= 0.18.0 → 0.18.1
- 2026-09-18 [CVE-2025-53837](https://erroneo.us/security/cve/CVE-2025-53837/index.md) org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue — org.xwiki.rendering:xwiki-rendering-xml < 14.10.2 → 14.10.2
- 2026-09-15 [CVE-2026-69204](https://erroneo.us/security/cve/CVE-2026-69204/index.md) Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) — org.http4s:http4s-ember-core_2.12 <= 0.23.34 → 0.23.35; org.http4s:http4s-ember-core_2.13 <= 0.23.34 → 0.23.35; org.http4s:http4s-ember-core_3 <= 0.23.34 → 0.23.35
- 2026-09-11 [CVE-2026-11746](https://erroneo.us/security/cve/CVE-2026-11746/index.md) Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover — com.linecorp.centraldogma:centraldogma-server < 0.84.0 → 0.84.0
- 2026-09-09 [CVE-2026-84939](https://erroneo.us/security/cve/CVE-2026-84939/index.md) Apache FreeMarker template loading mechanism vulnerable to path traversal — org.freemarker:freemarker >= 2.2.0, <= 2.3.34 → 2.3.35
- 2026-09-08 [CVE-2026-75595](https://erroneo.us/security/cve/CVE-2026-75595/index.md) Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext — io.netty:netty-handler >= 4.2.0.Final, <= 4.2.16.Final → 4.2.17.Final; io.netty:netty-handler <= 4.1.136.Final → 4.1.137.Final
- 2026-08-28 [CVE-2026-55565](https://erroneo.us/security/cve/CVE-2026-55565/index.md) Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) — org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; org.yamcs:yamcs-core <= 5.12.7 → 5.12.8
- 2026-08-28 [CVE-2026-55559](https://erroneo.us/security/cve/CVE-2026-55559/index.md) Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) — org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; org.yamcs:yamcs-core <= 5.12.7 → 5.12.8
- 2026-08-28 [CVE-2026-55511](https://erroneo.us/security/cve/CVE-2026-55511/index.md) Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` — org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1 → 5.13.2; org.yamcs:yamcs-core <= 5.12.7 → 5.12.8
- 2026-08-26 [CVE-2026-47884](https://erroneo.us/security/cve/CVE-2026-47884/index.md) Spring Framework Improper Path Limitation in XsltView — org.springframework:spring-webmvc <= 5.2.25.RELEASE → no fix; org.springframework:spring-webmvc >= 5.3.0, <= 5.3.49 → no fix; org.springframework:spring-webmvc >= 6.0.0, <= 6.0.30 → no fix
- 2026-08-26 [CVE-2026-47890](https://erroneo.us/security/cve/CVE-2026-47890/index.md) Spring Framework Server Sent Event stream corruption while rendering fragments — org.springframework:spring-webflux >= 6.2.0, <= 6.2.19 → no fix; org.springframework:spring-webflux >= 7.0.0, <= 7.0.8 → 7.0.9; org.springframework:spring-webmvc >= 6.2.0, <= 6.2.19 → no fix
- 2026-08-26 [CVE-2026-47892](https://erroneo.us/security/cve/CVE-2026-47892/index.md) Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints — org.springframework:spring-webflux >= 5.2.5.RELEASE, <= 5.2.25.RELEASE → no fix; org.springframework:spring-webflux >= 5.3.0, <= 5.3.49 → no fix; org.springframework:spring-webflux >= 6.0.0, <= 6.0.30 → no fix
- 2026-08-25 [CVE-2026-68525](https://erroneo.us/security/cve/CVE-2026-68525/index.md) Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability — org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.25 → 11.0.25; org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.58 → 10.1.58; org.apache.tomcat:tomcat >= 9.0.0-M1, < 9.0.121 → 9.0.121
- 2026-08-25 [CVE-2026-65182](https://erroneo.us/security/cve/CVE-2026-65182/index.md) Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability — org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.25 → 11.0.25; org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.58 → 10.1.58; org.apache.tomcat:tomcat >= 9.0.0-M1, < 9.0.121 → 9.0.121
- 2026-08-25 [CVE-2026-65905](https://erroneo.us/security/cve/CVE-2026-65905/index.md) Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability — org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.25 → 11.0.25; org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.58 → 10.1.58; org.apache.tomcat:tomcat >= 9.0.0.M1, < 9.0.121 → 9.0.121
- 2026-08-24 [CVE-2026-78329](https://erroneo.us/security/cve/CVE-2026-78329/index.md) Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes — org.apache.camel:camel-undertow >= 4.11.0, < 4.14.9 → 4.14.9; org.apache.camel:camel-undertow >= 4.15.0, < 4.18.4 → 4.18.4; org.apache.camel:camel-undertow >= 4.19.0, < 4.22.0 → 4.22.0
- 2026-08-24 [CVE-2026-71300](https://erroneo.us/security/cve/CVE-2026-71300/index.md) Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace — org.apache.camel:camel-atmosphere-websocket >= 4.0.0, < 4.14.9 → 4.14.9; org.apache.camel:camel-atmosphere-websocket >= 4.15.0, < 4.18.4 → 4.18.4; org.apache.camel:camel-atmosphere-websocket >= 4.19.0, < 4.22.0 → 4.22.0
- 2026-08-24 [CVE-2026-66906](https://erroneo.us/security/cve/CVE-2026-66906/index.md) Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir — org.apache.camel:camel-azure-storage-blob >= 4.0.0, < 4.14.9 → 4.14.9; org.apache.camel:camel-azure-storage-blob >= 4.15.0, < 4.18.4 → 4.18.4; org.apache.camel:camel-azure-storage-blob >= 4.19.0, < 4.22.0 → 4.22.0
- 2026-08-21 [CVE-2026-76904](https://erroneo.us/security/cve/CVE-2026-76904/index.md) GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers — org.geotools.jdbc:gt-jdbc-postgis = 35.0 → 35.1; org.geotools.jdbc:gt-jdbc-postgis >= 34.0, < 34.5 → 34.5; org.geotools.jdbc:gt-jdbc-postgis >= 30.5, < 33.6 → 33.6
- 2026-08-18 [CVE-2026-18963](https://erroneo.us/security/cve/CVE-2026-18963/index.md) Keycloak: Unauthenticated account takeover via reset-credentials flow bypass — org.keycloak:keycloak-services >= 26.0.0, < 26.4.15 → 26.4.15; org.keycloak:keycloak-services >= 26.5.0, < 26.6.6 → 26.6.6; org.keycloak:keycloak-services >= 26.7.0, < 26.7.2 → 26.7.2
- 2026-08-10 [CVE-2026-28672](https://erroneo.us/security/cve/CVE-2026-28672/index.md) Apache Ranger has a Command Injection vulnerability — org.apache.ranger:ranger >= 0.6.0, <= 2.8.0 → no fix
- 2026-08-02 [CVE-2026-8763](https://erroneo.us/security/cve/CVE-2026-8763/index.md) Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI — org.bouncycastle:bc-fips < 1.0.2.7 → 1.0.2.7; org.bouncycastle:bc-fips >= 2.0.0, < 2.0.2 → 2.0.2; org.bouncycastle:bc-fips >= 2.1.0, < 2.1.3 → 2.1.3
- 2026-07-24 [CVE-2026-62379](https://erroneo.us/security/cve/CVE-2026-62379/index.md) OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback — org.openidentityplatform.openam:openam-core <= 16.1.1 → 16.1.2
- 2026-07-24 [CVE-2026-73644](https://erroneo.us/security/cve/CVE-2026-73644/index.md) OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check — org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.1 → 5.1.2
- 2026-07-24 [CVE-2026-62263](https://erroneo.us/security/cve/CVE-2026-62263/index.md) OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass — org.openidentityplatform.openam:openam-auth-webauthn <= 16.1.1 → 16.1.2
- 2026-07-24 [GHSA-68r5-9hpg-7qw9](https://erroneo.us/security/ghsa/GHSA-68r5-9hpg-7qw9/index.md) OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway — org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1 → 5.1.2
- 2026-07-23 [CVE-2026-16723](https://erroneo.us/security/cve/CVE-2026-16723/index.md) fastjson has a remote code execution (RCE) vulnerability — com.alibaba:fastjson >= 1.2.68, <= 1.2.83 → no fix
- 2026-07-06 [CVE-2026-56140](https://erroneo.us/security/cve/CVE-2026-56140/index.md) Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy — org.apache.camel:camel-aws2-sns >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-aws2-sns >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-aws2-sns >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-40047](https://erroneo.us/security/cve/CVE-2026-40047/index.md) Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer — org.apache.camel:camel-docling >= 4.15.0, < 4.18.3 → 4.18.3
- 2026-07-06 [CVE-2026-46454](https://erroneo.us/security/cve/CVE-2026-46454/index.md) Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers — org.apache.camel:camel-cometd >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-cometd >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-cometd >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-53913](https://erroneo.us/security/cve/CVE-2026-53913/index.md) Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities — org.apache.camel:camel-keycloak >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-keycloak >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-46455](https://erroneo.us/security/cve/CVE-2026-46455/index.md) Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted — org.apache.camel:camel-keycloak >= 4.18.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-keycloak >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-48205](https://erroneo.us/security/cve/CVE-2026-48205/index.md) Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) — org.apache.camel:camel-dns >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-dns >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-dns >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-48204](https://erroneo.us/security/cve/CVE-2026-48204/index.md) Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers — org.apache.camel:camel-mongodb-gridfs >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-mongodb-gridfs >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-mongodb-gridfs >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-46456](https://erroneo.us/security/cve/CVE-2026-46456/index.md) Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers — org.apache.camel:camel-aws2-sqs >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-aws2-sqs >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-aws2-sqs >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-43867](https://erroneo.us/security/cve/CVE-2026-43867/index.md) Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter — org.apache.camel:camel-pqc >= 4.18.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-pqc >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-06 [CVE-2026-48203](https://erroneo.us/security/cve/CVE-2026-48203/index.md) Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields — org.apache.camel:camel-solr >= 4.0.0, < 4.14.8 → 4.14.8; org.apache.camel:camel-solr >= 4.15.0, < 4.18.3 → 4.18.3; org.apache.camel:camel-solr >= 4.19.0, < 4.21.0 → 4.21.0
- 2026-07-02 [CVE-2026-54617](https://erroneo.us/security/cve/CVE-2026-54617/index.md) LaunchServer FileServerHandler has an unauthenticated path traversal issue — pro.gravit.launcher:launchserver-api <= 5.7.11 → no fix
- 2026-06-24 [CVE-2026-45052](https://erroneo.us/security/cve/CVE-2026-45052/index.md) OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints — org.openidentityplatform.openam:openam-federation-library <= 16.0.6 → 16.1.1
- 2026-06-24 [CVE-2026-45051](https://erroneo.us/security/cve/CVE-2026-45051/index.md) OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage — org.openidentityplatform.openam:openam-auth-webauthn <= 16.0.6 → 16.1.1
- 2026-06-22 [CVE-2026-44179](https://erroneo.us/security/cve/CVE-2026-44179/index.md) xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro — com.xwiki.pro:xwiki-pro-macros >= 1.13, < 1.14.5 → 1.14.5
- 2026-06-22 [CVE-2026-12866](https://erroneo.us/security/cve/CVE-2026-12866/index.md) expr-eval vulnerable to Code Execution — expr-eval <= 2.0.2 → no fix; org.webjars.npm:expr-eval <= 2.0.2 → no fix
- 2026-06-22 [CVE-2026-44203](https://erroneo.us/security/cve/CVE-2026-44203/index.md) OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) — org.openidentityplatform.openam:openam-oauth2 >= 13.0.0, < 16.1.1 → 16.1.1
- 2026-06-22 [CVE-2026-46495](https://erroneo.us/security/cve/CVE-2026-46495/index.md) OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI — org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.0 → 5.1.1
- 2026-06-19 [CVE-2026-56120](https://erroneo.us/security/cve/CVE-2026-56120/index.md) OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete) — io.openremote:openremote-manager < 1.25.0 → 1.25.0
- 2026-06-17 [CVE-2026-32966](https://erroneo.us/security/cve/CVE-2026-32966/index.md) Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure — org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 → 3.4.2
- 2026-06-17 [CVE-2026-32967](https://erroneo.us/security/cve/CVE-2026-32967/index.md) Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks — org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 → 3.4.2
- 2026-06-17 [CVE-2026-55471](https://erroneo.us/security/cve/CVE-2026-55471/index.md) HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory — ca.uhn.hapi.fhir:org.hl7.fhir.utilities <= 6.9.9 → 6.9.10
- 2026-06-15 [CVE-2026-39006](https://erroneo.us/security/cve/CVE-2026-39006/index.md) SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component — org.snmp4j:snmp4j-agent <= 3.8.3 → no fix
- 2026-06-12 [CVE-2026-49875](https://erroneo.us/security/cve/CVE-2026-49875/index.md) Apache CXF has Improper Restriction of XML External Entity Reference — org.apache.cxf:cxf-core >= 4.2.0, < 4.2.2 → 4.2.2; org.apache.cxf:cxf-core < 4.1.7 → 4.1.7
- 2026-06-12 [CVE-2026-50633](https://erroneo.us/security/cve/CVE-2026-50633/index.md) Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl — org.apache.cxf:cxf-integration-jca >= 4.2.0, < 4.2.2 → 4.2.2; org.apache.cxf:cxf-integration-jca < 4.1.7 → 4.1.7
- 2026-06-12 [CVE-2026-50628](https://erroneo.us/security/cve/CVE-2026-50628/index.md) Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control — org.apache.cxf:cxf-rt-rs-security-oauth2 >= 4.2.0, < 4.2.2 → 4.2.2; org.apache.cxf:cxf-rt-rs-security-oauth2 < 4.1.7 → 4.1.7
- 2026-06-12 [CVE-2026-50627](https://erroneo.us/security/cve/CVE-2026-50627/index.md) Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator — org.apache.cxf:cxf-rt-rs-security-oauth2 >= 4.2.0, < 4.2.2 → 4.2.2; org.apache.cxf:cxf-rt-rs-security-oauth2 < 4.1.7 → 4.1.7
- 2026-06-12 [CVE-2026-50632](https://erroneo.us/security/cve/CVE-2026-50632/index.md) Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory — org.apache.cxf:cxf-rt-transports-jms >= 4.2.0, < 4.2.2 → 4.2.2; org.apache.cxf:cxf-rt-transports-jms >= 4.1.0, < 4.1.7 → 4.1.7; org.apache.cxf:cxf-rt-transports-jms < 3.6.12 → 3.6.12
- 2026-06-04 [CVE-2026-50076](https://erroneo.us/security/cve/CVE-2026-50076/index.md) Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path — org.apache.fory:fory-core < 1.1.0 → 1.1.0
- 2026-06-03 [CVE-2026-47065](https://erroneo.us/security/cve/CVE-2026-47065/index.md) Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass — org.apache.mina:mina-core >= 2.2.0, < 2.2.8 → 2.2.8; org.apache.mina:mina-core >= 2.1.0, < 2.1.13 → 2.1.13; org.apache.mina:mina-core < 2.0.29 → 2.0.29
- 2026-05-27 [CVE-2026-46562](https://erroneo.us/security/cve/CVE-2026-46562/index.md) Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override — org.yamcs:yamcs-core < 5.12.7 → 5.12.7
- 2026-05-27 [CVE-2026-46621](https://erroneo.us/security/cve/CVE-2026-46621/index.md) Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection — org.yamcs:yamcs-core < 5.12.7 → 5.12.7
- 2026-05-26 [CVE-2026-23734](https://erroneo.us/security/cve/CVE-2026-23734/index.md) XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash — org.xwiki.commons:xwiki-commons-classloader-api >= 4.2-milestone-2, < 16.10.17 → 16.10.17; org.xwiki.commons:xwiki-commons-classloader-api >= 17.0.0-rc-1, < 17.4.9 → 17.4.9; org.xwiki.commons:xwiki-commons-classloader-api >= 17.5.0, < 17.10.3 → 17.10.3
- 2026-05-26 [CVE-2026-33137](https://erroneo.us/security/cve/CVE-2026-33137/index.md) XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} — org.xwiki.platform:xwiki-platform-rest-server >= 15.10.6, < 16.10.17 → 16.10.17; org.xwiki.platform:xwiki-platform-rest-server >= 17.0.0-rc-1, < 17.4.9 → 17.4.9; org.xwiki.platform:xwiki-platform-rest-server >= 17.5.0, < 17.10.3 → 17.10.3
- 2026-05-26 [CVE-2026-44930](https://erroneo.us/security/cve/CVE-2026-44930/index.md) Apache CXF has an LDAP injection vulnerability — org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap = 4.2.0 → 4.2.1; org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap >= 4.1.0, < 4.1.6 → 4.1.6; org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap < 3.6.11 → 3.6.11
- 2026-05-26 [CVE-2026-44632](https://erroneo.us/security/cve/CVE-2026-44632/index.md) Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` — org.yamcs:yamcs-core < 5.12.7 → 5.12.7
- 2026-05-19 [CVE-2026-2586](https://erroneo.us/security/cve/CVE-2026-2586/index.md) GlassFish's Administration Console is Vulnerable to RCE — org.glassfish.main.admingui:console-common < 8.0.2 → 8.0.2; org.glassfish.jsftemplating:jsftemplating < 4.2.0 → 4.2.0
- 2026-05-19 [CVE-2026-47323](https://erroneo.us/security/cve/CVE-2026-47323/index.md) Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering — org.apache.camel:camel-cxf-rest >= 3.18.0, < 4.14.6 → 4.14.6; org.apache.camel:camel-cxf-rest >= 4.15.0, < 4.18.2 → 4.18.2
- 2026-05-19 [CVE-2026-2587](https://erroneo.us/security/cve/CVE-2026-2587/index.md) GlassFish's gadget handler is vulnerable to RCE — org.glassfish.main.admingui:admingui < 8.0.2 → 8.0.2; org.glassfish.jsftemplating:jsftemplating < 4.2.0 → 4.2.0
- 2026-05-14 [CVE-2026-8178](https://erroneo.us/security/cve/CVE-2026-8178/index.md) Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading — com.amazon.redshift:redshift-jdbc42 < 2.2.2 → 2.2.2
- 2026-05-13 [CVE-2026-45083](https://erroneo.us/security/cve/CVE-2026-45083/index.md) Goobi viewer - Core: Unauthenticated Solr Streaming Expression Proxy — io.goobi.viewer:viewer-core >= 4.8.0, <= 26.04 → no fix
- 2026-05-12 [CVE-2026-45091](https://erroneo.us/security/cve/CVE-2026-45091/index.md) sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) — sealed-env < 0.1.0-alpha.4 → 0.1.0-alpha.4; io.github.davidalmeidac:sealed-env-core < 0.1.0-alpha.4 → 0.1.0-alpha.4
- 2026-05-12 [CVE-2026-41293](https://erroneo.us/security/cve/CVE-2026-41293/index.md) Apache Tomcat - HTTP/2 request headers not validated — org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.55 → 10.1.55; org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.22 → 11.0.22; org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.55 → 10.1.55
- 2026-05-12 [CVE-2026-44672](https://erroneo.us/security/cve/CVE-2026-44672/index.md) Mapfish Print: Remote Code Injection (RCE) in Dynamic table — org.mapfish.print:print-lib >= 3.23.0, < 3.28.28 → 3.28.28; org.mapfish.print:print-lib >= 3.29.0, < 3.30.30 → 3.30.30; org.mapfish.print:print-lib >= 3.31.0, < 3.31.21 → 3.31.21
- 2026-05-12 [CVE-2026-43512](https://erroneo.us/security/cve/CVE-2026-43512/index.md) Apache Tomcat - Digest authenticator will authenticate any unknown user — org.apache.tomcat.embed:tomcat-embed-core < 9.0.118 → 9.0.118; org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.55 → 10.1.55; org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.22 → 11.0.22
- 2026-05-12 [CVE-2026-33117](https://erroneo.us/security/cve/CVE-2026-33117/index.md) Security feature bypass vulnerability in Azure Key Vault Keys library for Java — com.azure:azure-security-keyvault-keys < 4.10.6 → 4.10.6
- 2026-05-12 [CVE-2026-43515](https://erroneo.us/security/cve/CVE-2026-43515/index.md) Apache Tomcat - Security constraints not correctly applied — org.apache.tomcat.embed:tomcat-embed-core < 9.0.118 → 9.0.118; org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0-M1, < 10.1.55 → 10.1.55; org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.22 → 11.0.22
- 2026-05-11 [CVE-2026-27478](https://erroneo.us/security/cve/CVE-2026-27478/index.md) Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation — io.unitycatalog:unitycatalog-server <= 0.4.0 → 0.4.1
- 2026-05-06 [CVE-2026-40010](https://erroneo.us/security/cve/CVE-2026-40010/index.md) Apache Wicket has a Session Fixation issue — org.apache.wicket:wicket-auth-roles >= 8.0.0-M1, <= 8.17.0 → no fix; org.apache.wicket:wicket-auth-roles >= 9.0.0-M1, <= 9.22.0 → no fix; org.apache.wicket:wicket-auth-roles >= 10.0.0-M1, <= 10.8.0 → 10.9.0
- 2026-05-06 [CVE-2026-42555](https://erroneo.us/security/cve/CVE-2026-42555/index.md) Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users — com.ritense.valtimo:document >= 12.0.0, < 12.32.0 → 12.32.0; com.ritense.valtimo:case >= 13.0.0, < 13.23.0 → 13.23.0; com.ritense.valtimo:contract >= 13.4.0, < 13.23.0 → 13.23.0
- 2026-05-06 [CVE-2026-40982](https://erroneo.us/security/cve/CVE-2026-40982/index.md) Spring Cloud Config vulnerable to Path Traversal — org.springframework.cloud:spring-cloud-config-server >= 4.1.0, <= 4.1.9 → no fix; org.springframework.cloud:spring-cloud-config-server >= 4.2.0, <= 4.2.6 → no fix; org.springframework.cloud:spring-cloud-config-server >= 4.3.0, <= 4.3.2 → 4.3.3
- 2026-05-05 [CVE-2026-44221](https://erroneo.us/security/cve/CVE-2026-44221/index.md) ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases — com.arcadedb:arcadedb-server >= 21.10.1, < 26.4.2 → 26.4.2
- 2026-05-05 [CVE-2026-7411](https://erroneo.us/security/cve/CVE-2026-7411/index.md) Eclipse BaSyx Java Server SDK vulnerable to Path Traversal — org.eclipse.basyx:basyx.sdk < 2.0.0-milestone-10 → 2.0.0-milestone-10
- 2026-05-04 [CVE-2026-41258](https://erroneo.us/security/cve/CVE-2026-41258/index.md) OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange — org.openmrs.api:openmrs-api >= 2.7.0, < 2.7.9 → 2.7.9; org.openmrs.api:openmrs-api >= 2.8.0, < 2.8.6 → 2.8.6
- 2026-05-04 [CVE-2026-42812](https://erroneo.us/security/cve/CVE-2026-42812/index.md) Apache Polaris has an Improper Input Validation issue — org.apache.polaris:polaris-runtime-service >= 0.9.0, < 1.4.1 → 1.4.1
- 2026-05-04 [CVE-2026-42810](https://erroneo.us/security/cve/CVE-2026-42810/index.md) Apache Polaris has an Improper Input Validation Issue — org.apache.polaris:polaris-core < 1.4.1 → 1.4.1
- 2026-05-04 [CVE-2026-42811](https://erroneo.us/security/cve/CVE-2026-42811/index.md) Apache Polaris has an Improper Input Validation issue — org.apache.polaris:polaris-core < 1.4.1 → 1.4.1
- 2026-05-04 [CVE-2026-42027](https://erroneo.us/security/cve/CVE-2026-42027/index.md) Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest — org.apache.opennlp:opennlp-tools >= 3.0.0-M1, < 3.0.0-M3 → 3.0.0-M3; org.apache.opennlp:opennlp-tools >= 2.0.0, < 2.5.9 → 2.5.9; org.apache.opennlp:opennlp-tools < 1.9.5 → 1.9.5
- 2026-05-04 [CVE-2026-41901](https://erroneo.us/security/cve/CVE-2026-41901/index.md) Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns — org.thymeleaf:thymeleaf <= 3.1.4.RELEASE → 3.1.5.RELEASE; org.thymeleaf:thymeleaf-spring5 <= 3.1.4.RELEASE → 3.1.5.RELEASE; org.thymeleaf:thymeleaf-spring6 <= 3.1.4.RELEASE → 3.1.5.RELEASE
- 2026-05-04 [CVE-2026-42809](https://erroneo.us/security/cve/CVE-2026-42809/index.md) Apache Polaris has an Improper Input Validation Issue — org.apache.polaris:polaris-runtime-service < 1.4.1 → 1.4.1
- 2026-05-04 [CVE-2026-40076](https://erroneo.us/security/cve/CVE-2026-40076/index.md) OpenMRS Module Upload Vulnerable to Path Traversal (Zip Slip) — org.openmrs.web:openmrs-web <= 2.7.8 → no fix; org.openmrs.web:openmrs-web >= 2.8.0, <= 2.8.5 → no fix
- 2026-05-04 [CVE-2026-40682](https://erroneo.us/security/cve/CVE-2026-40682/index.md) Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing — org.apache.opennlp:opennlp-tools >= 3.0.0-M1, < 3.0.0-M3 → 3.0.0-M3; org.apache.opennlp:opennlp-tools >= 2.0.0, < 2.5.9 → 2.5.9; org.apache.opennlp:opennlp-tools < 1.9.5 → 1.9.5
- 2026-05-01 [CVE-2026-42779](https://erroneo.us/security/cve/CVE-2026-42779/index.md) Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix) — org.apache.mina:mina-core >= 2.1.0, < 2.1.12 → 2.1.12; org.apache.mina:mina-core >= 2.2.0, < 2.2.7 → 2.2.7
- 2026-05-01 [CVE-2026-42778](https://erroneo.us/security/cve/CVE-2026-42778/index.md) Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41409 Incomplete Fix) — org.apache.mina:mina-core >= 2.1.0, < 2.1.12 → 2.1.12; org.apache.mina:mina-core >= 2.2.0, < 2.2.7 → 2.2.7
- 2026-04-30 [CVE-2026-36767](https://erroneo.us/security/cve/CVE-2026-36767/index.md) Shopizer has a path traversal issue — com.shopizer:shopizer <= 2.16.0 → no fix
- 2026-04-29 [CVE-2026-42523](https://erroneo.us/security/cve/CVE-2026-42523/index.md) Jenkins GitHub Plugin has an XSS vulnerability — com.coravy.hudson.plugins.github:github < 1.46.0.1 → 1.46.0.1
- 2026-04-29 [CVE-2026-41586](https://erroneo.us/security/cve/CVE-2026-41586/index.md) fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE — org.hyperledger.fabric-sdk-java:fabric-sdk-java >= 1.0.0, <= 2.2.26 → no fix
- 2026-04-27 [CVE-2026-40860](https://erroneo.us/security/cve/CVE-2026-40860/index.md) Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage — org.apache.camel:camel-jms >= 3.0.0, < 4.14.7 → 4.14.7; org.apache.camel:camel-jms >= 4.15.0, < 4.18.2 → 4.18.2; org.apache.camel:camel-jms >= 4.19.0, < 4.20.0 → 4.20.0
- 2026-04-27 [CVE-2026-40453](https://erroneo.us/security/cve/CVE-2026-40453/index.md) Apache Camel has an incomplete fix for CVE-2025-27636 — org.apache.camel:camel-coap >= 3.0.0, < 4.14.6 → 4.14.6; org.apache.camel:camel-coap >= 4.15.0, < 4.18.2 → 4.18.2; org.apache.camel:camel-coap >= 4.19.0, < 4.20.0 → 4.20.0
- 2026-04-27 [CVE-2026-41409](https://erroneo.us/security/cve/CVE-2026-41409/index.md) Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix) — org.apache.mina:mina-core >= 2.0.0, < 2.0.28 → 2.0.28; org.apache.mina:mina-core >= 2.1.0, < 2.1.11 → 2.1.11; org.apache.mina:mina-core >= 2.2.0, < 2.2.6 → 2.2.6

Pages: https://erroneo.us/security/ecosystem/maven/index.md · https://erroneo.us/security/ecosystem/maven/2/index.md · https://erroneo.us/security/ecosystem/maven/3/index.md · https://erroneo.us/security/ecosystem/maven/4/index.md

---
Source page: https://erroneo.us/security/ecosystem/maven/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt