1883 matches found
org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-22709 via org.webjars.npm:vm2 (3.9.19)
org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...
org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23957 via org.webjars.npm:seroval (1.2.1)
org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23957 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054526...
org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23956 via org.webjars.npm:seroval (1.2.1)
org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23956 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054521...
cn.herodotus.engine:oauth2-authentication-autoconfigure (>=3.5.5.3, <=3.5.6.2), cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.5, <=3.5.5.2) +2 more potentially affected by CVE-2026-23967 via org.webjars.npm:sm-crypto (0.3.13)
org.webjars.npm:sm-crypto MAVEN version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sm-crypto and may be impacted: - cn.herodotus.engine:oauth2-authentication-autoconfigure =3.5.5.3, =3.3.0.5, =3.3.0.5, =3.5.5.3, =3.5.6.2...
br.com.jarch:jarch-apt (>=20.3.0, <=24.1.0), br.com.jarch:jarch-core (>=20.3.0, <=24.1.0) +32 more potentially affected by CVE-2025-65482 via fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx (>=0.9.5, <=2.2.0)
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document.docx MAVEN version =0.9.5, =20.3.0, =20.3.0, =2.23.5, =24.2.0, =23.1.0, =2.23.0, =2.0, =2.0, =2.0, =2.2.4, =2.0, =2.2.4, =2.2.4, =2.2.4, =2.2.7 and more Source cves: CVE-2025-65482 Source advisory: SNYK:JAVA-FROPENSAGRESXDOCREPORT-1504671...
MiracleLinux 8 : maven:3.5 (AXSA:2022-3741:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3741:01 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the MiracleLin...
MiracleLinux 8 : maven:3.6 (AXSA:2022-3738:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3738:01 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the MiracleLin...
MiracleLinux 8 : maven:3.5 (AXSA:2022-3572:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3572:01 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block...
com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.1, <=1.2.2), com.webank.wedatasphere.dss:dss-apiservice-server (>=1.1.0, <=1.2.2) +192 more potentially affected by CVE-2025-29847 via org.apache.linkis:linkis-common (>=1.0.3, <=1.8.0)
org.apache.linkis:linkis-common MAVEN version =1.0.3, =1.1.1, =1.1.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.1.2, =1.0.1, =1.0.1, =1.1.0, =1.0.1, =1.0.1, =1.1.0, =1.1.0, =1.2.2 and more Source cves: CVE-2025-29847 Source advisory: SNYK:JAVA-ORGAPACHELINKIS-15035881https://vulners.com/snyk...
net.risesoft:risenet-y9boot-support-platform-service (9.7.0-rc3), net.risesoft:risenet-y9boot-support-platform-web (9.7.0-rc3) potentially affected by CVE-2026-1050 via net.risesoft:risenet-y9boot-support-platform-jpa-repository (9.7.0-rc3)
net.risesoft:risenet-y9boot-support-platform-jpa-repository MAVEN version 9.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on net.risesoft:risenet-y9boot-support-platform-jpa-repository and may be impacted: -...
net.risesoft:risenet-y9boot-support-platform-web (9.7.0-rc3) potentially affected by CVE-2026-1050 via net.risesoft:risenet-y9boot-support-platform-service (9.7.0-rc3)
net.risesoft:risenet-y9boot-support-platform-service MAVEN version 9.7.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on net.risesoft:risenet-y9boot-support-platform-service and may be impacted: - net.risesoft:risenet-y9boot-support-platform-web...
org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-22036 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)
org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...
org.iplass:iplass-admin (>=4.0.0, <=4.0.23), org.iplass:iplass-gem (>=4.0.0, <=4.0.23) +8 more potentially affected by CVE-2025-15056 via org.webjars.npm:quill (>=0.19.12, <=2.0.2)
org.webjars.npm:quill MAVEN version =0.19.12, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =0.2.2, =2.10.2, =2.10.3-ssr.3 Source cves: CVE-2025-15056 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14927398...
This Week in Spring - January 13th, 2026
Hi, Spring fans, and welcome to another installment of This Week in Spring! It's the 13th of January, 2026, and it's been quite the week indeed! Let's dive right into it! Nobody, and I mean nobody , asked. So I put together a video on how to use Spring WS to build SOAP-based services in 2026. Hey...
br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +272 more potentially affected by CVE-2025-68493 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.3.37)
org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =2.0.0, =1.2.4, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =2.2.1 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...
be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +58 more potentially affected by CVE-2025-68493 via com.opensymphony:xwork (>=2.0.4, <=2.1.3)
com.opensymphony:xwork MAVEN version =2.0.4, =1.2.1, =4.0.1, =0.9.2, =1.1.5, =1.3.3, =1.3.1, =2.0.5-incubating, =2.0.9, =2.0.11, =2.0.9, =2.0.9, =2.0.9, =2.1.6 - org.apache.struts:struts2-convention-plugin 2.1.6 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...
CVE-2025-23215
PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...
CVE-2019-16550
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents...
CVE-2019-16549
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents...
