org.apache.maven.plugins:maven-dependency-plugin (2.0-alpha-1), org.apache.maven.shared:maven-test-tools (1.0-alpha-1) +7 more potentially affected by CVE-2025-67030 via org.codehaus.plexus:plexus-utils (1.4-alpha-1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.apache.maven.plugins:maven-dependency-plugin 2.0-alpha-1 -...

CVE-2026-32735 Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735 Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735

The CVE concerns the project openapi-to-java-records-mustache-templates and its parent POM. Between versions 5.1.1 and 5.5.1, the parent POM (used to centralize plugin configurations) uses maven-dependency-plugin to unpack arbitrary .mustache files from the same-version artifact. Although the par...

CVE-2026-32735

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735 Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2026-32735: Improper Input Validation

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

PT-2026-26163

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

Recommended update for Maven

This update for Maven fixes the following issues: maven-dependency-analyzer was updated from version 1.13.2 to 1.15.1: Key changes across versions: Bug fixes and improved support of dynamic types Dependency upgrades ASM, Maven core, and notably the removal of commons-io Improved error handling by...

CVE-2024-10897

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...

Fedora: Security Advisory for maven-dependency-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

org.apache.maven.plugins:maven-dependency-plugin (2.0-alpha-1), org.apache.maven.shared:maven-test-tools (1.0-alpha-1) +7 more potentially affected by CVE-2022-4244 via org.codehaus.plexus:plexus-utils (1.4-alpha-1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.apache.maven.plugins:maven-dependency-plugin 2.0-alpha-1 -...

org.apache.maven.plugins:maven-dependency-plugin (2.0-alpha-1), org.apache.maven.shared:maven-test-tools (1.0-alpha-1) +7 more potentially affected by CVE-2022-4245 via org.codehaus.plexus:plexus-utils (1.4-alpha-1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.apache.maven.plugins:maven-dependency-plugin 2.0-alpha-1 -...

com.github.jlgrock.javascript-framework:source-archive-maven-plugin (>=1.10.3, <=1.18.3), com.savage7.maven.plugins:maven-external-dependency-plugin (0.5) +2 more potentially affected by CVE-2023-37460 via org.codehaus.plexus:plexus-archiver (1.1)

org.codehaus.plexus:plexus-archiver MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.github.jlgrock.javascript-framework:source-archive-maven-plugin =1.10.3, =2.2, =2.0.7,...

Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Install the...

com.github.jlgrock.javascript-framework:source-archive-maven-plugin (>=1.10.3, <=1.18.3), com.savage7.maven.plugins:maven-external-dependency-plugin (0.5) +2 more potentially affected by CVE-2018-1002200 via org.codehaus.plexus:plexus-archiver (1.1)

org.codehaus.plexus:plexus-archiver MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.github.jlgrock.javascript-framework:source-archive-maven-plugin =1.10.3, =2.2, =2.0.7,...

org.apache.maven.plugins:maven-dependency-plugin (2.0-alpha-1), org.apache.maven.shared:maven-test-tools (1.0-alpha-1) +7 more potentially affected by CVE-2017-1000487 via org.codehaus.plexus:plexus-utils (1.4-alpha-1)

org.codehaus.plexus:plexus-utils MAVEN version 1.4-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - org.apache.maven.plugins:maven-dependency-plugin 2.0-alpha-1 -...