org.apache.camel.maven:camel-salesforce-maven-plugin (>=4.19.0, <=4.20.0), org.apache.camel.quarkus:camel-quarkus-integration-test-salesforce (>=3.35.0, <=3.36.0) +6 more potentially affected by CVE-2026-49099 via org.apache.camel:camel-salesforce (>=4.19.0, <=4.20.0)

org.apache.camel:camel-salesforce MAVEN version =4.19.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.20.0 - org.apache.nifi:nifi-salesforce-nar 2.10.0 - org.apache.nifi:nifi-salesforce-processors 2.10.0 Source cves: CVE-2026-49099 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875080...

org.apache.camel.kafkaconnector:camel-salesforce-composite-upsert-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-salesforce-create-sink-kafka-connector (4.18.0) +13 more potentially affected by CVE-2026-49099 via org.apache.camel:camel-salesforce (>=4.15.0, <=4.18.2)

org.apache.camel:camel-salesforce MAVEN version =4.15.0, =4.18.1, =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.15.0, =2.7.0, =2.7.0, =2.9.0 Source cves: CVE-2026-49099 Source advisory: MEND:CVE-...

dev.sigstore:sigstore-maven-plugin (2.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.14, <=2.0.18) +1 more potentially affected by CVE-2026-48791 via dev.sigstore:sigstore-java (2.0.0)

dev.sigstore:sigstore-java MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.sigstore:sigstore-java and may be impacted: - dev.sigstore:sigstore-maven-plugin 2.0.0 - org.apache.maven.resolver:maven-resolver-generator-sigstore...

dev.sigstore:sigstore-maven-plugin (>=2.0.0-rc1, <=2.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.14, <=2.0.18) +1 more potentially affected by CVE-2026-48791 via dev.sigstore:sigstore-java (>=2.0.0-rc1, <=2.0.0)

dev.sigstore:sigstore-java MAVEN version =2.0.0-rc1, =2.0.0-rc1, =2.0.14, =2.0.14, =2.0.18 Source cves: CVE-2026-48791 Source advisory: SNYK:JAVA-DEVSIGSTORE-17753965...

dev.sigstore:sigstore-maven-plugin (2.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.14, <=2.0.18) +1 more potentially affected by CVE-2026-48791 via dev.sigstore:sigstore-java (2.0.0)

dev.sigstore:sigstore-java MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.sigstore:sigstore-java and may be impacted: - dev.sigstore:sigstore-maven-plugin 2.0.0 - org.apache.maven.resolver:maven-resolver-generator-sigstore...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.6) +5 more potentially affected by CVE-2026-54475 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.6 Source cves: CVE-2026-54475 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17738992...

org.apache.activemq.tooling:activemq-maven-plugin (6.2.6), org.apache.activemq:activemq-osgi (6.2.6) +4 more potentially affected by CVE-2026-50750 via org.apache.activemq:activemq-all (6.2.6)

org.apache.activemq:activemq-all MAVEN version 6.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq.tooling:activemq-maven-plugin 6.2.6 - org.apache.activemq:activemq-osgi 6.2...

org.apache.activemq.tooling:activemq-maven-plugin (6.2.6), org.apache.activemq:activemq-osgi (6.2.6) +4 more potentially affected by CVE-2026-50750 via org.apache.activemq:activemq-all (6.2.6)

org.apache.activemq:activemq-all MAVEN version 6.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq.tooling:activemq-maven-plugin 6.2.6 - org.apache.activemq:activemq-osgi 6.2...

org.apache.activemq.tooling:activemq-maven-plugin (5.19.7), org.apache.activemq:activemq-osgi (5.19.7) +4 more potentially affected by CVE-2026-50750 via org.apache.activemq:activemq-all (5.19.7)

org.apache.activemq:activemq-all MAVEN version 5.19.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq.tooling:activemq-maven-plugin 5.19.7 - org.apache.activemq:activemq-osgi...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.6) +5 more potentially affected by CVE-2026-53916 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.6 Source cves: CVE-2026-53916 Source advisory: MEND:CVE-2026-53916...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.6) +5 more potentially affected by CVE-2026-53917 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.6 Source cves: CVE-2026-53917 Source advisory: MEND:CVE-2026-53917...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.6) +5 more potentially affected by CVE-2026-54475 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.6)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.6 Source cves: CVE-2026-54475 Source advisory: MEND:CVE-2026-54475...

SUSE CVE-2026-13502

A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the readObject function of the Maven Plugin component. An attacker can manipulate the state between the time a check is performed and the time it is used by exploiting a race condition,...

co.cask.re:dre-core (>=1.0.1, <=1.1.2), co.cask.re:dre-plugins (>=1.0.1, <=1.1.2) +53 more potentially affected by CVE-2026-13502 via org.antlr:antlr4-maven-plugin (>=4.1, <=4.13.2)

org.antlr:antlr4-maven-plugin MAVEN version =4.1, =1.0.1, =1.0.1, =1.0, =0.1, =1.5.2, =1.4.8, =1.6.5 and more Source cves: CVE-2026-13502 Source advisory: SNYK:JAVA-ORGANTLR-17753946...

CVE-2026-13502

A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is...

UBUNTU-CVE-2026-13502

A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is...

CVE-2026-13502

A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is...

CVE-2026-13502

The CVE-2026-13502 entry concerns antlr ANTLR4 up to 4.13.2. It affects the function ObjectInputStream.readObject in the antlr4-maven-plugin’s GrammarDependencies.java, indicating a time-of-check time-of-use issue. The attack is restricted to local execution and requires a high degree of complexi...

CVE-2026-13502

A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java of the component Maven Plugin. This manipulation causes time-of-check time-of-use. The attack is...