ch.admin.bit.jeap:jeap-archrepo-docgen (>=2.10.0, <=16.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-messagetype (>=1.10.0, <=16.2.0) +532 more potentially affected by CVE-2026-94002 via org.apache.sshd:sshd-sftp (>=2.0.0, <=2.19.0)

org.apache.sshd:sshd-sftp MAVEN version =2.0.0, =2.10.0, =1.10.0, =1.10.0, =1.15.0, =1.10.0, =1.10.0, =1.10.0, =1.10.0, =3.26.0, =3.26.0, =3.26.0, =3.26.0, =1.6.0, =1.1.0, =1.1.1 and more Source cves: CVE-2026-94002 Source advisory: MEND:CVE-2026-94002...

ch.admin.bit.jeap:jeap-archrepo-docgen (>=6.3.0, <=8.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-openapi (>=6.3.0, <=8.2.0) +17 more potentially affected by CVE-2026-18061 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.1.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =23.3.0, =8.9.11, =4.128.0, =5.0.2 and more Source cves: CVE-2026-18061 Source advisory: SNYK:JAVA-SOFTWAREAMAZONJDBC-19778365...

ch.admin.bit.jeap:jeap-archrepo-docgen (>=6.3.0, <=8.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-openapi (>=6.3.0, <=8.2.0) +17 more potentially affected by CVE-2026-18061 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.1.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =23.3.0, =8.9.11, =4.128.0, =5.0.2 and more Source cves: CVE-2026-18061 Source advisory: MEND:CVE-2026-18061...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-security (1.1.0) +1551 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-web MAVEN version =7.0.0, =0.2.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

ch.admin.bit.jeap:jeap-archrepo-instance (>=1.10.0, <=1.23.0), ch.admin.bit.jeap:jeap-archrepo-test (>=1.10.0, <=1.23.0) +482 more potentially affected by CVE-2026-22748 via org.springframework.security:spring-security-oauth2-jose (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.4.0, =1.10.0, =1.10.0, =1.10.0, =1.55.1, =1.55.1, =3.1.0, =3.1.0, =8.4.0, =1.0.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.16.0, =17.38.0 and more Source cves: CVE-2026-22748 Source advisory: MEN...

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +1130 more potentially affected by CVE-2026-22751 via org.springframework.security:spring-security-core (>=7.0.0-m1, <=7.0.4)

org.springframework.security:spring-security-core MAVEN version =7.0.0-m1, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

ch.admin.bit.jeap:jeap-message-contract-domain (>=3.26.0, <=4.11.0), ch.admin.bit.jeap:jeap-message-contract-messagetype-registry (>=3.26.0, <=4.11.0) +54 more potentially affected by CVE-2025-33042 via org.apache.avro:avro-compiler (1.12.0)

org.apache.avro:avro-compiler MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.avro:avro-compiler and may be impacted: - ch.admin.bit.jeap:jeap-message-contract-domain =3.26.0, =3.26.0, =3.26.0, =3.26.0, =8.15.0, =8.15.0,...

CVE-2014-3518

The CVE-2014-3518 vulnerability affects jmx-remoting.sar in JBoss Remoting, used by Red Hat JBoss EAP 5.2.x and related Red Hat platforms (JEAP 5.2.0, BRMS 5.3.1, Portal Platform 5.2.2, SOA Platform 5.3.1). The root cause is incomplete implementation of the JSR 160 JMX remoting specification, all...

Xxe

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...

CVE-2014-3481

CVE-2014-3481 is an XXE information-disclosure flaw in Red Hat JBoss Enterprise Application Platform 6.x's JAX-RS/RESTEasy stack (enabled external entity processing). Affected: JEAP 6.x prior to 6.2.4. Impact: read arbitrary files. Remediation: upgrade to Red Hat JBoss EAP 6.2.4 (or equivalent se...

CVE-2014-3481: Exposure of Sensitive Information to an Unauthorized Actor

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...