CVE-2025-60012-POC

For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer CVE-2025-60012 — Apache Livy Unauthorized File Access -yellow Overview Field| Detail ---|--- CVE ID| CVE-2025-60012 Severity| Medium CVSS 6....

CVE-2025-66249-POC

CVE-2025-66249 — Apache Livy Path Traversal Whitelist Bypass For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer Overview Field| Detail ---|--- CVE ID| CVE-2025-66249 Severity| Important CVSS...

lazylist-cve-poc

CVE-2022-36944 payload generator This mini-project is created to demonstrate proof of concept of CVE-2022-36944 vulnerability. It is similar to ysoserial, but generates payload only for this CVE with LazyList class. Quick FAQ What artifacts bring the vulnerability? org.scala-lang:scala-library wi...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, infinispan, flyway, tez, cass-config-builder, sonarqube, scala, trino, apache-tika, keycloak, logstash, apicurio-registry, dependency-track, opensearch, apache-nifi-registry, wildfly, gradle, apache-nifi, keycloak-config-cli, akhq, spark,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, infinispan, flyway, tez, cass-config-builder, sonarqube, scala, trino, apache-tika, keycloak, logstash, apicurio-registry, dependency-track, opensearch, apache-nifi-registry, wildfly, gradle, apache-nifi, keycloak-config-cli, akhq, spark,...

GHSA-CJX3-73HR-RPW7 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: OSV:GHSA-CJX3-73HR-RPW7...

http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: GHSA-CJX3-73HR-RPW7...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: GHSA-CJX3-73HR-RPW7...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: OSV:GHSA-CJX3-73HR-RPW7...

CVE-2026-61741

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741

The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks in versions prior to 0.24.1 and 1.0.0-M39 . The root cause is the use of SAXParserFactory.newInstance to obtain a javax.xml.parsers.SAXParserFactory without any security configuration, allowing the parser to resolve D...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: MEND:CVE-2026-61741...

CVE-2026-61741

http4s-scala-xml provides "EntityDecoderF, scala.xml.Elem" instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a "javax.xml.parsers.SAXParserFactory" obtained from "SAXParserFactory.newInstance" without any security configuration. With the JDK's...

EUVD-2026-86332

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: MEND:CVE-2026-61741...