CLEANSTART-2026-EB16054 ACE vulnerability in configuration file processing by QOS

Security vulnerability affects the sonar-scanner package. ACE vulnerability in configuration file processing by QOS...

CLEANSTART-2026-HH28532 Security fix for GHSA-qqpg-mvqg-649v applied in: sonar-scanner 8.0.1.6346-r0

Security vulnerability affects the sonar-scanner package. This issue is resolved in later releases. See references for vulnerability details...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, trino, cassandra, apache-nifi-registry, sonar-scanner-cli, thingsboard, akhq, cassandra-reaper, nextflow, apache-nifi, zookeeper, keycloak-config-cli, dependency-track, kserve-modelmesh...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, trino, cassandra, apache-nifi-registry, sonar-scanner-cli, thingsboard, akhq, cassandra-reaper, nextflow, apache-nifi, zookeeper, keycloak-config-cli, dependency-track, kserve-modelmesh...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, sonar-scanner-cli, thingsboard, knative-kafka-broker-fips, cassandra-reaper, nextflow, dependency-track, zookeeper-fips, nacos-docker, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, zookeeper, cassandra-fips,...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, sonar-scanner-cli, thingsboard, knative-kafka-broker-fips, cassandra-reaper, nextflow, dependency-track, zookeeper-fips, nacos-docker, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, zookeeper, cassandra-fips,...

CVE-2025-48924 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, sonar-scanner-cli, thingsboard, druid, flyway, apache-tika, wildfly, cassandra-reaper, zipkin, nextflow, dependency-track, apicurio-registry, celeborn, sonarqube, spdx-tools-java, apache-activemq-artemis, akhq, gradle, nrjmx, spark, apache-nifi,...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, sonar-scanner-cli, thingsboard, druid, flyway, apache-tika, wildfly, cassandra-reaper, zipkin, nextflow, dependency-track, apicurio-registry, celeborn, sonarqube, spdx-tools-java, apache-activemq-artemis, akhq, gradle, nrjmx, spark, apache-nifi,...

GHSA-J288-Q9X7-2F5V vulnerabilities

Vulnerabilities for packages: automq, kafka, apache-nifi-registry, sonar-scanner-cli, thingsboard, druid, flyway, apache-tika, wildfly, cassandra-reaper, zipkin, apache-hop, nextflow, dependency-track, solr-fips, tritonserver-backend-vllm-cuda-12.9, apache-hop-fips, apicurio-registry, celeborn,...

GHSA-6V67-2WR5-GVF4 vulnerabilities

Vulnerabilities for packages: sonar-scanner-cli, thingsboard, cassandra-reaper, sonarqube-10, dependency-track, sonarqube, zookeeper-fips, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, cassandra-fips, management-api-for-apache-cassandra-4.0, trino, cassandra, ontop,...

GHSA-PR98-23F8-JWXV vulnerabilities

Vulnerabilities for packages: sonar-scanner-cli, thingsboard, cassandra-reaper, sonarqube-10, dependency-track, sonarqube, zookeeper-fips, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, cassandra-fips, management-api-for-apache-cassandra-4.0, trino, cassandra, ontop,...

CVE-2024-12801 vulnerabilities

Vulnerabilities for packages: sonar-scanner-cli, thingsboard, cassandra-reaper, sonarqube-10, dependency-track, sonarqube, zookeeper-fips, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, cassandra-fips, management-api-for-apache-cassandra-4.0, trino, cassandra, ontop,...

CVE-2024-12798 vulnerabilities

Vulnerabilities for packages: sonar-scanner-cli, thingsboard, cassandra-reaper, sonarqube-10, dependency-track, sonarqube, zookeeper-fips, hadoop-fips, akhq, management-api-for-apache-cassandra-4.1, apache-nifi, cassandra-fips, management-api-for-apache-cassandra-4.0, trino, cassandra, ontop,...

com.github.sbaudoin:sonar-ansible-api (>=2.4.0, <=2.5.1), com.github.sbaudoin:sonar-ansible-plugin (>=2.4.0, <=2.5.1) +13 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.7.7)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - com.github.sbaudoin:sonar-ansible-api =2.4.0, =2.4.0, =0.1.0, =0.1.3 -...

org.sonarsource.sonarqube:sonar-ce (5.6-rc1), org.sonarsource.sonarqube:sonar-core (5.6-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.6-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.6-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.6-rc1 -...

org.sonarsource.sonarqube:sonar-ce (5.6-rc2), org.sonarsource.sonarqube:sonar-core (5.6-rc2) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (5.6-rc2)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 5.6-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 5.6-rc2 -...

org.sonarsource.scm.git:sonar-scm-git-plugin (1.3.0.869), org.sonarsource.scm.svn:sonar-scm-svn-plugin (1.6.0.860) +12 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.6-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.6-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.scm.git:sonar-scm-git-plugin 1.3.0.869 -...

com.github.rigoford:sonar-java-rules (>=0.1.0, <=0.3.0), org.sonarsource.sonarqube:sonar-ce (6.2.1) +7 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.2.1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - com.github.rigoford:sonar-java-rules =0.1.0, =0.3.0 -...

org.sonarsource.sonarqube:sonar-ce (6.2-rc1), org.sonarsource.sonarqube:sonar-core (6.2-rc1) +6 more potentially affected by CVE-2018-19413 via org.sonarsource.sonarqube:sonar-plugin-api (6.2-rc1)

org.sonarsource.sonarqube:sonar-plugin-api MAVEN version 6.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.sonarsource.sonarqube:sonar-plugin-api and may be impacted: - org.sonarsource.sonarqube:sonar-ce 6.2-rc1 -...

SonarSource SonarQube Authentication Bypass Vulnerability

SonarSource SonarQube is an open source code quality management system from SonarSource Switzerland. An authentication bypass vulnerability exists in SonarQube version 8.4.2.36762, which allows an external attacker to implement authentication bypass via SonarScanner to create and overwrite public...