jetty-line-check

jetty-line-check Which of these six 2026 CVEs has your Jetty or the Jetty pulled in by Spring Boot been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central? The headline is CVE-2026-2332 GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4: chunked reque...

CLEANSTART-2026-RI15436 In Eclipse Parsson published Maven Central artifacts before version 1

Security vulnerability affects the apache-nifi package. In Eclipse Parsson published Maven Central artifacts before version 1...

CLEANSTART-2026-YW73278 In Eclipse Parsson published Maven Central artifacts before version 1

Security vulnerability affects the keycloak package. In Eclipse Parsson published Maven Central artifacts before version 1...

cov-int

XWiki Commons XWiki Commons are technical libraries common to several other top level XWiki projects. These libraries can be used by projects outside of the XWiki ecosystem, are generic and not related to the wiki domain. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org...

codehaus-plexus__plexus-archiver_CVE-2018-1002200_3-5

Plexus-archiver The current master is now at https://github.com/codehaus-plexus/plexus-archiver Release Notes You can find details about the different releases in the Release Notes. Release 3.4. Release 3.3. Release 3.2...

CLEANSTART-2026-ZO54886 In Eclipse Parsson published Maven Central artifacts before version 1

CVE-2026-9563 affects multiple packages. In Eclipse Parsson published Maven Central artifacts before version 1. See references for individual vulnerability details...

CLEANSTART-2026-WV26329 In Eclipse Parsson published Maven Central artifacts before version 1

Security vulnerability affects the keycloak package. In Eclipse Parsson published Maven Central artifacts before version 1...

fastjson

fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...

CLEANSTART-2026-IC85563 In Eclipse Parsson published Maven Central artifacts before version 1

Security vulnerability affects the sonarqube package. In Eclipse Parsson published Maven Central artifacts before version 1...

PT-2026-108424

Security vulnerability affects the sonarqube package. In Eclipse Parsson published Maven Central artifacts before version 1...

CVE-2026-9563

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memo...

CVE-2026-9563

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memo...

This Week in Spring - June 30th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring , a weekly recap in which we review the latest and greatest in the wide and wonderful world of Spring. You probably already knew this. I don't know if I needed to mention it. But I like to. I've been doing this every week,...

GHSA-HWQH-2684-54FC Spring Cloud Gateway's SSL bundle configuration silently bypassed

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud...

Spring Cloud Gateway's SSL bundle configuration silently bypassed

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud...

CVE-2026-22750: External Control of System or Configuration Setting

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud...

On the Variability of Source Code in Maven Package Rebuilds

Rebuilding packages from open source is a common practice to improve the security of software supply chains, and is now done at an industrial scale. The basic principle is to acquire the source code used to build a package published in a repository such as Maven Central for Java, rebuild the...

CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

MSC-2025-11604

A sophisticated malicious package discovered on Maven Central exploits typosquatting by using the org.fasterxml.jackson.core namespace to impersonate the legitimate Jackson JSON library published under com.fasterxml.jackson.core. aikido The malware implements a multi-stage payload with encrypted...

Shai-Hulud v2 Spreads From npm to Maven, as Campaign Exposes Thousands of Secrets

The second wave of the Shai-Hulud supply chain attack has spilled over to the Maven ecosystem after compromising more than 830 packages in the npm registry. The Socket Research Team said it identified a Maven Central package named org.mvnpm:posthog-node:4.18.1 that embeds the same two components...