ch.admin.bit.jeap:jeap-archrepo-docgen (>=6.3.0, <=8.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-openapi (>=6.3.0, <=8.2.0) +17 more potentially affected by CVE-2026-18061 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.1.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =23.3.0, =8.9.11, =4.128.0, =5.0.2 and more Source cves: CVE-2026-18061 Source advisory: SNYK:JAVA-SOFTWAREAMAZONJDBC-19778365...

XML External Entity (XXE) Injection

Overview software.amazon.jdbc:aws-advanced-jdbc-wrapper is an Amazon Web Services AWS Advanced JDBC Wrapper Affected versions of this package are vulnerable to XML External Entity XXE Injection via the CachedSQLXML.getSource path in...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

ch.admin.bit.jeap:jeap-archrepo-docgen (>=6.3.0, <=8.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-openapi (>=6.3.0, <=8.2.0) +17 more potentially affected by CVE-2026-18061 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.1.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =23.3.0, =8.9.11, =4.128.0, =5.0.2 and more Source cves: CVE-2026-18061 Source advisory: MEND:CVE-2026-18061...

EUVD-2026-76153

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061

An XML External Entity (XXE) vulnerability exists in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 . An actor with write access to the shared cache infrastructure can inject crafted XML data into a cached column value, allowing them to disclose sensitive fil...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

PT-2026-89910

Name of the Vulnerable Software and Affected Versions AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 Description Improper restriction of XML external entity XXE references in the RemoteQueryCachePlugin allows an actor with write access to the shared cache infrastructure to disclose...

CVE-2026-18061: Improper Restriction of XML External Entity Reference

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=5.0.2) +3 more potentially affected by CVE-2026-11400 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.2.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.2.0, =8.9.0-alpha5-rc1, =4.128.0, =5.0.2 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack 11.4.0.fin...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=5.0.2) +3 more potentially affected by CVE-2026-11400 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.2.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.2.0, =8.9.0-alpha5-rc1, =4.128.0, =5.0.2 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack 11.4.0.fin...

io.camunda:camunda-zeebe (>=8.10.0-alpha1-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=5.0.2) +3 more potentially affected by CVE-2026-14265 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =8.10.0-alpha1-rc1, =4.128.0, =5.0.2 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack...

io.camunda:camunda-zeebe (>=8.10.0-alpha1-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=5.0.2) +3 more potentially affected by CVE-2026-14265 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =8.10.0-alpha1-rc1, =4.128.0, =5.0.2 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack...

CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a...

CVE-2026-14265: Deserialization of Untrusted Data

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.10.0-alpha1), org.finos.legend.engine:legend-engine-xt-relationalstore-aurora-execution (>=4.128.0, <=5.0.2) +3 more potentially affected by CVE-2026-11400 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.2.0, <=4.0.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.2.0, =8.9.0-alpha5-rc1, =4.128.0, =5.0.2 - org.wildfly:wildfly-datasources-galleon-pack 11.4.0.final - org.wildfly:wildfly-datasources-galleon-pack-common 11.4.0.final - org.wildfly:wildfly-datasources-preview-galleon-pack 11.4.0.fin...

Untrusted Search Path

Overview software.amazon.jdbc:aws-advanced-jdbc-wrapper is an Amazon Web Services AWS Advanced JDBC Wrapper Affected versions of this package are vulnerable to Untrusted Search Path in the GlobalAuroraPgDialect, which is included in the public schema. A low-privileged user can elevate privileges ...