CVE-2020-17521Medium· 5.5▾ SunlitApache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.1%
1.1% → 1.1%
Last analysed / modified upstream
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
groovy >= 2.0.0, <= 2.4.20groovy >= 2.5.0, <= 2.5.13groovy >= 3.0.0, <= 3.0.6groovy = 4.0.0snapcenteragile_engineering_data_management = 6.2.1.0agile_plm_mcad_connector = 3.4agile_plm_mcad_connector = 3.6agile_product_lifecycle_management = 9.3.3agile_product_lifecycle_management = 9.3.6business_process_management_suite = 12.2.1.3.0business_process_management_suite = 12.2.1.4.0communications_brm_-_elastic_charging_engine = 11.3.0.9.0communications_brm_-_elastic_charging_engine = 12.0.0.3communications_diameter_signaling_router = 8.4.0.0communications_evolved_communications_application_server = 7.1communications_services_gatekeeper = 6.0communications_services_gatekeeper = 6.1communications_services_gatekeeper = 7.0healthcare_data_repository = 7.0.2hospitality_opera_5 = 5.6ilearning = 6.2ilearning = 6.3insurance_policy_administration >= 11.0, <= 11.3.1jd_edwards_enterpriseone_orchestrator = 9.2.6.0primavera_gateway >= 17.12.0, <= 17.12.10primavera_unifier >= 17.7, <= 17.12primavera_unifier = 16.1primavera_unifier = 16.2primavera_unifier = 18.8primavera_unifier = 19.12primavera_unifier = 20.12retail_bulk_data_integration = 15.0.3.0retail_bulk_data_integration = 16.0.3.0retail_merchandising_system = 16.0.3retail_store_inventory_management = 14.1.3.10retail_store_inventory_management = 15.0.3.5retail_store_inventory_management = 16.0.3.5atlas = 2.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71575Critical· 9.1The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity
CVE-2026-108039High· 7.5By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document
CVE-2026-107938Critical· 9.1In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called
CVE-2026-107937High· 7.5In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits
CVE-2026-100227High· 7.5Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
CVE-2026-92415Medium· 5.3— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantia…