lazylist-cve-poc

CVE-2022-36944 payload generator This mini-project is created to demonstrate proof of concept of CVE-2022-36944 vulnerability. It is similar to ysoserial, but generates payload only for this CVE with LazyList class. Quick FAQ What artifacts bring the vulnerability? org.scala-lang:scala-library wi...

CVE-2025-60012-POC

For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer CVE-2025-60012 — Apache Livy Unauthorized File Access -yellow Overview Field| Detail ---|--- CVE ID| CVE-2025-60012 Severity| Medium CVSS 6....

CVE-2025-66249-POC

CVE-2025-66249 — Apache Livy Path Traversal Whitelist Bypass For educational and security research purposes only. Do not use against systems you do not own or have explicit written permission to test. →Full Disclaimer Overview Field| Detail ---|--- CVE ID| CVE-2025-66249 Severity| Important CVSS...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: flyway, apache-tika, logstash, infinispan, scala, spark, apicurio-registry, apache-nifi-registry, trino, cass-config-builder, tez, sonarqube, keycloak, opensearch, wildfly, strimzi-kafka-operator, keycloak-config-cli, apache-nifi, gradle, akhq, spdx-tools-java,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: flyway, apache-tika, logstash, infinispan, scala, spark, apicurio-registry, apache-nifi-registry, trino, cass-config-builder, tez, sonarqube, keycloak, opensearch, wildfly, strimzi-kafka-operator, keycloak-config-cli, apache-nifi, gradle, akhq, spdx-tools-java,...

http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE...

GHSA-CJX3-73HR-RPW7 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: GHSA-CJX3-73HR-RPW7...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: OSV:GHSA-CJX3-73HR-RPW7...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: OSV:GHSA-CJX3-73HR-RPW7...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: GHSA-CJX3-73HR-RPW7...

CVE-2026-61741

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

EUVD-2026-86332

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741

http4s-scala-xml provides "EntityDecoderF, scala.xml.Elem" instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a "javax.xml.parsers.SAXParserFactory" obtained from "SAXParserFactory.newInstance" without any security configuration. With the JDK's...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: MEND:CVE-2026-61741...

com.meltwater.fawn:auth_2.13 (>=0.1, <=0.2), com.meltwater.fawn:s3_2.13 (0.2) +2 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.13 (>=0.21.7, <=0.21.31)

org.http4s:http4s-scala-xml2.13 MAVEN version =0.21.7, =0.1, =0.1, =1.2.2, =1.5.0 Source cves: CVE-2026-61741 Source advisory: MEND:CVE-2026-61741...

CVE-2026-61741

The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks in versions prior to 0.24.1 and 1.0.0-M39 . The root cause is the use of SAXParserFactory.newInstance to obtain a javax.xml.parsers.SAXParserFactory without any security configuration, allowing the parser to resolve D...