DependencyCheck

Dependency-Check Dependency-Check is a Software Composition Analysis SCA tool that attempts to detect publicly disclosed vulnerabilities contained within a project's dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found...

mvn_pwn

MVN PWN Malicious Maven pom.xml that uses "groovy-maven-plugin" to get RCE Full payload with dependencies can be found at the following blog: https://security.humanativaspa.it/abusing-mavens-pom-xml/...

Protection Mechanism Failure

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or...

com.github.pukkaone:logback-gelf (>=1.1.5, <=1.1.9), com.globo.graylog2:gelfj (>=1.1.16.0, <=1.1.16.1) +13 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.0.4)

com.rabbitmq:amqp-client MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.pukkaone:logback-gelf =1.1.5, =1.1.16.0, =2.0.0, =1.1.3, =1.2, =1.2, =1.5 Source cves: CVE-2026-1061...

com.github.pukkaone:logback-gelf (>=1.1.5, <=1.1.9), com.globo.graylog2:gelfj (>=1.1.16.0, <=1.1.16.1) +13 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.0.4)

com.rabbitmq:amqp-client MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.pukkaone:logback-gelf =1.1.5, =1.1.16.0, =2.0.0, =1.1.3, =1.2, =1.2, =1.5 Source cves: CVE-2026-1061...

org.liquibase:liquibase-cdi (>=4.13.0, <=4.14.0), org.liquibase:liquibase-maven-plugin (4.13.0) potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.20)

net.snowflake:snowflake-jdbc MAVEN version 3.13.20 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.liquibase:liquibase-cdi =4.13.0, =4.14.0 - org.liquibase:liquibase-maven-plugin 4.13.0 Source cve...

com.snowflake:snowflake-maven-plugin (0.1.0), org.liquibase:liquibase-cdi (>=4.19.1, <=4.20.0) potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.27)

net.snowflake:snowflake-jdbc MAVEN version 3.13.27 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.snowflake:snowflake-maven-plugin 0.1.0 - org.liquibase:liquibase-cdi =4.19.1, =4.20.0 Source cves...

com.codbex.atlas:codbex-atlas-application (>=2.77.0, <=2.79.0), com.codbex.gaia:codbex-gaia-application (>=2.68.0, <=2.70.0) +19 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.26.1)

net.snowflake:snowflake-jdbc MAVEN version 3.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.codbex.atlas:codbex-atlas-application =2.77.0, =2.68.0, =2.60.0, =2.65.0, =2.59.0, =2.61.0, =3.21....

org.apache.hop:hop-transform-snowflake-bulkloader (>=2.2.0, <=2.4.0), org.finos.legend.engine:legend-engine-xt-persistence-component-relational-snowflake (>=release-4.96.3, <=4.141.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc (3.13.19)

net.snowflake:snowflake-jdbc MAVEN version 3.13.19 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.apache.hop:hop-transform-snowflake-bulkloader =2.2.0, =release-4.96.3, =4.141.0 -...

io.github.epi155:promethium-pgp-jdk5 (0.5-b1), org.igniterealtime.smack:smack-android (>=4.5.0-alpha2, <=4.5.0-beta2) +196 more potentially affected by CVE-2026-85515 via org.bouncycastle:bcpg-jdk15to18 (>=1.72.1, <=1.84)

org.bouncycastle:bcpg-jdk15to18 MAVEN version =1.72.1, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-beta3, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =4.5.0-alpha2, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.10.0 and more Source cves: CVE-2026-85515 Source advisory:...

org.apache.karaf.features:spring (>=4.1.0, <=4.4.10), org.apache.karaf.features:spring-legacy (>=4.1.0, <=4.4.10) +1 more potentially affected by CVE-2026-92230 via org.apache.karaf.deployer:org.apache.karaf.deployer.spring (>=4.0.0.m1, <=4.4.10)

org.apache.karaf.deployer:org.apache.karaf.deployer.spring MAVEN version =4.0.0.m1, =4.1.0, =4.1.0, =4.0.0.m1, =4.4.10 Source cves: CVE-2026-92230 Source advisory: MEND:CVE-2026-92230...

com.github.cloudfoundry-community:snotel (>=0.3.m1, <=0.3.m3), com.github.cloudfoundry-community:snotel-spring-boot-config (>=0.3.m1, <=0.3.m3) +6 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.8.0)

com.squareup.wire:wire-runtime MAVEN version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.github.cloudfoundry-community:snotel =0.3.m1, =0.3.m1, =0.3.m1, =0.6.0beta, =0.0.3, =0.0.4 Sour...

com.squareup.wire:wire-compiler (2.0.0-beta3), com.squareup.wire:wire-gson-support (2.0.0-beta3) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.0-beta3)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta3 - com.squareup.wire:wire-gson-support 2.0.0-beta3...

com.squareup.wire:wire-compiler (1.3.1), com.squareup.wire:wire-gson-support (1.3.1) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.1)

com.squareup.wire:wire-runtime MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.1 - com.squareup.wire:wire-gson-support 1.3.1 -...

com.squareup.wire:wire-compiler (1.4.0), com.squareup.wire:wire-gson-support (1.4.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.4.0)

com.squareup.wire:wire-runtime MAVEN version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.4.0 - com.squareup.wire:wire-gson-support 1.4.0 -...

com.squareup.wire:wire-compiler (1.5.0), com.squareup.wire:wire-gson-support (1.5.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.0)

com.squareup.wire:wire-runtime MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.5.0 - com.squareup.wire:wire-gson-support 1.5.0 -...

com.squareup.retrofit:converter-wire (>=1.7.0, <=1.9.0), com.squareup.wire:wire-compiler (1.5.2) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.2)

com.squareup.wire:wire-runtime MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire =1.7.0, =1.9.0 - com.squareup.wire:wire-compiler 1.5.2 -...

com.squareup.wire:wire-compiler (2.0.0-beta4), com.squareup.wire:wire-gson-support (2.0.0-beta4) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.0-beta4)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta4 - com.squareup.wire:wire-gson-support 2.0.0-beta4...

com.squareup.retrofit:converter-wire (1.6.1), com.squareup.wire:wire-compiler (1.5.1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.1)

com.squareup.wire:wire-runtime MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire 1.6.1 - com.squareup.wire:wire-compiler 1.5.1 -...

com.squareup.wire:wire-compiler (1.3.2), com.squareup.wire:wire-gson-support (1.3.2) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.2)

com.squareup.wire:wire-runtime MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.2 - com.squareup.wire:wire-gson-support 1.3.2 -...