Tagged “maven”
CVEs tagged maven, newest first.
454 CVEsRSS
CVE-2026-52760Medium· 6.1Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
Apache ActiveMQ, Apache ActiveMQ Web Console vulnerable to Cross-site Scripting
CVE-2026-49432High· 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp has an Improper Input Validation vulnerability
CVE-2026-54475High· 7.5Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Missing Authorization vulnerability
CVE-2026-49434High· 7.5Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
CVE-2026-50734High· 7.5Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
CVE-2026-49877High· 8.1Apache ActiveMQ Improper Authorization vulnerability
Apache ActiveMQ Improper Authorization vulnerability
CVE-2026-50750High· 7.5Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
CVE-2026-53917High· 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
CVE-2025-53648Medium· 5.4SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade to version 1.0.0, which fixes this issue.
SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade to version 1.0.0, which fixes this issue.
CVE-2026-55956Medium· 6.5Apache Tomcat has an Improper Authorization vulnerability
Apache Tomcat has an Improper Authorization vulnerability
CVE-2026-55957High· 7.3PoCApache Tomcat has a Missing Critical Step in Authentication vulnerability
Apache Tomcat has a Missing Critical Step in Authentication vulnerability
CVE-2026-55955Medium· 6.5⚖ disputedImproper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…
CVE-2026-55276Critical· 9.1⚖ disputedAlways-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.…
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.…
CVE-2026-53434Critical· 9.1⚖ disputedDetection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 th…
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 th…
CVE-2026-53404High· 7.3Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0…
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0…
CVE-2026-50229Medium· 6.1PoCImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…
CVE-2026-57915High· 7.3Apache Kerby has a bypass the Kerberos pre-authentication check
Apache Kerby has a bypass the Kerberos pre-authentication check
CVE-2026-57914Medium· 6.5Apache Kerby vulnerable to denial of service
Apache Kerby vulnerable to denial of service
GHSA-gqj5-2xp5-3qmpHigh· 8.1Duplicate Advisory: Authentication bypass via jwt algorithm confusion
Duplicate Advisory: Authentication bypass via jwt algorithm confusion
CVE-2025-55017Critical· 9.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to versio…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to versio…
CVE-2025-64152Critical· 9.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to versio…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to versio…
CVE-2026-12993Medium· 6.5A flaw was found in Apicurio Registry
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission …
CVE-2026-56091HighApache Shiro shiro-guice module vulnerable to authentication bypass
Apache Shiro shiro-guice module vulnerable to authentication bypass
CVE-2026-56130LowApache Shiro's "remember me" cookie age is not verified on the server.
Apache Shiro's "remember me" cookie age is not verified on the server.
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-q929-g23j-2rc7Medium· 6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
GHSA-79qw-g39g-mfxcHigh· 8.1Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
GHSA-gfv4-4vr2-rr4gMedium· 4.6Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-12992High· 7.4A flaw was found in Apicurio Registry
A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload …