# cve.now: Maven packages

The newest entries affecting Maven packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [CVE-2026-45049](https://cve.now/CVE-2026-45049.md): OpenAM Session Hijacking via CDSSO (CVSS 8.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-118259](https://cve.now/CVE-2026-118259.md): opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing (CVSS 5.3, open-telemetry opentelemetry-java · io.opentelemetry:opente…)
- [CVE-2026-44179](https://cve.now/CVE-2026-44179.md): XWiki Pro Macros: excerpt-include title and content injection executes code (CVSS 9.9, xwikisas xwiki-pro-macros · com.xwiki.pro:xwiki-pro-macros)
- [CVE-2026-116590](https://cve.now/CVE-2026-116590.md): snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite (CVSS 5.9, xerial snappy-java · org.xerial.snappy:snappy-java)
- [CVE-2026-113730](https://cve.now/CVE-2026-113730.md): OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies (CVSS 5.6, orphan-oss ognl · ognl:ognl)
- [CVE-2026-111765](https://cve.now/CVE-2026-111765.md): A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix (CVSS 7.5, a2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-http-…)
- [CVE-2026-111764](https://cve.now/CVE-2026-111764.md): A2A Java SDK has a fail-open default task authorization (CVSS 7.5, a2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-serve…)
- [CVE-2026-111763](https://cve.now/CVE-2026-111763.md): A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect (CVSS 5.7, a2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-parent)
- [CVE-2026-111762](https://cve.now/CVE-2026-111762.md): A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure (CVSS 5.7, a2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-trans…)
- [CVE-2026-111761](https://cve.now/CVE-2026-111761.md): A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery (CVSS 5.8, a2aproject a2a-java · org.a2aproject.sdk:a2a-java-sdk-serve…)
- [CVE-2026-102834](https://cve.now/CVE-2026-102834.md): JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS (CVSS 7.5, bytedeco javacv · org.bytedeco:javacv)
- [CVE-2026-97370](https://cve.now/CVE-2026-97370.md): Junrar: RarVM VM\_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction (CVSS 7.5, junrar · com.github.junrar:junrar)
- [CVE-2026-55414](https://cve.now/CVE-2026-55414.md): NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF) (CVSS 5.3, nl-portal-backend-libraries · nl.nl-portal:form)
- [CVE-2026-54683](https://cve.now/CVE-2026-54683.md): NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463) (CVSS 6.5, nl-portal-backend-libraries · nl.nl-portal:documenten-api)
- [CVE-2026-102695](https://cve.now/CVE-2026-102695.md): OmniFaces: Forged combined-resource IDs and related output/push boundaries (CVSS 8.2, omnifaces · org.omnifaces:omnifaces)
- [CVE-2026-54641](https://cve.now/CVE-2026-54641.md): OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl (CVSS 7.7, openremote · io.openremote:openremote-manager)
- [CVE-2026-54640](https://cve.now/CVE-2026-54640.md): OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory (CVSS 7.6, openremote · io.openremote openremote-manager +1)
- [CVE-2026-54697](https://cve.now/CVE-2026-54697.md): ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing (CVSS 6.7, connectbot cbssh · org.connectbot.sshlib:sshlib)
- [CVE-2026-54700](https://cve.now/CVE-2026-54700.md): ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation (CVSS 6.9, connectbot cbssh · org.connectbot.sshlib:sshlib)
- [CVE-2026-107226](https://cve.now/CVE-2026-107226.md): AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-102554](https://cve.now/CVE-2026-102554.md): Denial of Service via Eager Array Allocation During Deserialization in Guava (CVSS 8.2, Google Guava · com.google.guava:guava)
- [CVE-2026-108106](https://cve.now/CVE-2026-108106.md): Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service (CVSS 8.7, xerial snappy-java · org.xerial.snappy:snappy-java)
- [CVE-2026-107726](https://cve.now/CVE-2026-107726.md): Hazelcast: Arbitrary member memory access by low-privileged client (CVSS 9.3, hazelcast · com.hazelcast:hazelcast)
- [CVE-2026-107725](https://cve.now/CVE-2026-107725.md): Hazelcast: Authorization bypass in IMap Predicates API (CVSS 8.7, hazelcast · com.hazelcast:hazelcast)
- [CVE-2026-107285](https://cve.now/CVE-2026-107285.md): AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel (CVSS 5.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107283](https://cve.now/CVE-2026-107283.md): AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source (CVSS 3.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107282](https://cve.now/CVE-2026-107282.md): AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host (CVSS 9.4, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107280](https://cve.now/CVE-2026-107280.md): AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk (CVSS 6.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107231](https://cve.now/CVE-2026-107231.md): AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext (CVSS 8.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107230](https://cve.now/CVE-2026-107230.md): AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins (CVSS 7.4, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107228](https://cve.now/CVE-2026-107228.md): AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-107227](https://cve.now/CVE-2026-107227.md): AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled (CVSS 7.5, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-106453](https://cve.now/CVE-2026-106453.md): yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError (CVSS 5.3, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-106452](https://cve.now/CVE-2026-106452.md): yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header (CVSS 5.3, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-106451](https://cve.now/CVE-2026-106451.md): yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user (CVSS 7.3, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-106450](https://cve.now/CVE-2026-106450.md): yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs (CVSS 5.3, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-106449](https://cve.now/CVE-2026-106449.md): yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError (CVSS 3.7, yawkat lz4-java · at.yawk.lz4:lz4-java +1)
- [CVE-2026-106123](https://cve.now/CVE-2026-106123.md): RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() (CVSS 5.7, rabbitmq-java-client · com.rabbitmq amqp-client +1)
- [CVE-2026-106122](https://cve.now/CVE-2026-106122.md): RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers (CVSS 6.0, rabbitmq-java-client · com.rabbitmq amqp-client +1)
- [CVE-2026-106121](https://cve.now/CVE-2026-106121.md): RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS (CVSS 4.9, rabbitmq-java-client · com.rabbitmq amqp-client +1)
- [CVE-2026-54049](https://cve.now/CVE-2026-54049.md): Sakai Conversations has a Stored XSS Issue (CVSS 8.7, sakaiproject sakai · org.sakaiproject.conversations:saka… +2)
- [CVE-2026-103922](https://cve.now/CVE-2026-103922.md): Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path (CVSS 9.3, ionic-team capacitor · @capacitor android +6)
- [CVE-2026-100834](https://cve.now/CVE-2026-100834.md): http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass (CVSS 8.2, http4k · org.http4k:http4k-security-digest)
- [CVE-2026-100725](https://cve.now/CVE-2026-100725.md): http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage (CVSS 8.3, http4k · org.http4k:http4k-core)
- [CVE-2026-100724](https://cve.now/CVE-2026-100724.md): http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy (CVSS 6.3, http4k · org.http4k:http4k-core)
- [CVE-2026-61741](https://cve.now/CVE-2026-61741.md): http4s-scala-xml has an XML External Entity (XXE) processing issue (CVSS 9.3, http4s-scala-xml · org.http4s:http4s-scala-xml\_2.12 +2)
- [CVE-2026-59990](https://cve.now/CVE-2026-59990.md): Jawn: Uncontrolled nesting depth in JSON parser (CVSS 7.5, typelevel jawn · org.typelevel:jawn-parser\_2.12 +2)
- [CVE-2026-61814](https://cve.now/CVE-2026-61814.md): Jawn: Quadratic parsing effort in AsyncParser (CVSS 7.5, typelevel jawn · org.typelevel jawn-parser\_2.12 +5)
- [CVE-2026-77420](https://cve.now/CVE-2026-77420.md): JLine: ReDoS via \`HISTORY\_IGNORE\` Configuration Variable (CVSS 5.5, jline3 · org.jline:jline-reader)
- [CVE-2026-77422](https://cve.now/CVE-2026-77422.md): JLine: ReDoS in Built-in grep Command Amplified by Automatic \`.\*\` Wrapping (CVSS 7.5, jline3 · org.jline:jline-builtins)
- [CVE-2026-77421](https://cve.now/CVE-2026-77421.md): JLine: ReDoS in Nano Editor Regex Search Mode (CVSS 6.5, jline3 · org.jline:jline-builtins)
- [CVE-2026-95848](https://cve.now/CVE-2026-95848.md): Moquette fails open when configured authentication or authorization classes cannot load (CVSS 9.3, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95847](https://cve.now/CVE-2026-95847.md): Moquette client IDs can cause cross-session H2 durable-queue corruption (CVSS 8.8, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95846](https://cve.now/CVE-2026-95846.md): Moquette publishes Last-Will messages without enforcing write authorization (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95845](https://cve.now/CVE-2026-95845.md): Moquette unbounded per-session message queues allow memory exhaustion (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95844](https://cve.now/CVE-2026-95844.md): Moquette deeply nested MQTT topics can cause stack exhaustion (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95843](https://cve.now/CVE-2026-95843.md): Moquette malformed shared subscriptions can crash command processing (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-95842](https://cve.now/CVE-2026-95842.md): Moquette uncaught MQTT command exceptions can terminate shared session event loops (CVSS 8.7, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-85724](https://cve.now/CVE-2026-85724.md): Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass (CVSS 9.6, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-91777](https://cve.now/CVE-2026-91777.md): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (CVSS 7.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-91776](https://cve.now/CVE-2026-91776.md): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID (CVSS 7.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1)
- [CVE-2026-89425](https://cve.now/CVE-2026-89425.md): jackson-core: UTF8DataInputJsonParser.\_reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth (CVSS 7.5, FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · MPXJ.Net +5)
- [CVE-2026-89407](https://cve.now/CVE-2026-89407.md): jackson-core: quadratic backtracking in NumberInput.PATTERN\_FLOAT via looksLikeValidNumber() enables ReDoS (CVSS 7.5, FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1)
- [CVE-2026-69190](https://cve.now/CVE-2026-69190.md): Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards (CVSS 6.3, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-85058](https://cve.now/CVE-2026-85058.md): Moquette: Missing Authorization in io.moquette:moquette-broker (CVSS 7.5, moquette-io moquette · io.moquette:moquette-broker)
- [CVE-2026-54147](https://cve.now/CVE-2026-54147.md): http4k: \`DigestAuthProvider.verify\` ignored configured algorithm and did not bind to request URI (CVSS 6.5, http4k · org.http4k:http4k-security-digest)
- [CVE-2026-54148](https://cve.now/CVE-2026-54148.md): http4k: \`DigestAuthProvider.verify\` did not bind to request URI (CVSS 8.1, http4k · org.http4k:http4k-security-digest)
- [CVE-2025-53837](https://cve.now/CVE-2025-53837.md): org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue (CVSS 9.9, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2026-93451](https://cve.now/CVE-2026-93451.md): snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods (CVSS 6.9, xerial snappy-java · org.xerial.snappy:snappy-java)
- [CVE-2026-77615](https://cve.now/CVE-2026-77615.md): Paella Player: Stored XSS via caption cue text (CVSS 8.7, opencast · polimediaupv paella-player +2)
- [CVE-2026-54617](https://cve.now/CVE-2026-54617.md): GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler (CVSS 9.8, GravitLauncher Launcher · pro.gravit.launcher:launchserver-…)
- [CVE-2026-85716](https://cve.now/CVE-2026-85716.md): AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified (CVSS 3.7, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-85720](https://cve.now/CVE-2026-85720.md): AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request (CVSS 5.9, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-85721](https://cve.now/CVE-2026-85721.md): AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service (CVSS 7.5, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-85717](https://cve.now/CVE-2026-85717.md): AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target (CVSS 6.8, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-61700](https://cve.now/CVE-2026-61700.md): MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests (CVSS 3.7, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-86071](https://cve.now/CVE-2026-86071.md): Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root (CVSS 3.7, junrar · com.github.junrar:junrar)
- [CVE-2026-81876](https://cve.now/CVE-2026-81876.md): HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +2)
- [CVE-2026-81875](https://cve.now/CVE-2026-81875.md): HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +2)
- [CVE-2026-75516](https://cve.now/CVE-2026-75516.md): RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement (CVSS 8.7, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2026-63126](https://cve.now/CVE-2026-63126.md): Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799) (CVSS 7.5, square wire · com.squareup.wire:wire-runtime)
- [CVE-2026-88975](https://cve.now/CVE-2026-88975.md): Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS\_MAX\_FRAME\_SIZE (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.13 +2)
- [CVE-2026-69206](https://cve.now/CVE-2026-69206.md): Http4s: DigestAuth allows replay of captured requests (CVSS 5.9, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69202](https://cve.now/CVE-2026-69202.md): Http4s Ember HTTP/2: unbounded inbound body buffering (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69218](https://cve.now/CVE-2026-69218.md): Http4s Ember HTTP/2: unbounded continuation frame accumulation (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69203](https://cve.now/CVE-2026-69203.md): Http4s Ember HTTP/2: does not enforce SETTINGS\_MAX\_CONCURRENT\_STREAMS (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69215](https://cve.now/CVE-2026-69215.md): Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2)
- [CVE-2026-69205](https://cve.now/CVE-2026-69205.md): Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (CVSS 8.7, http4s · org.http4s:http4s-ember-core\_3 +2)
- [CVE-2026-69213](https://cve.now/CVE-2026-69213.md): Http4s Ember HTTP/2: unbounded outbound frame queue (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69214](https://cve.now/CVE-2026-69214.md): Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2)
- [CVE-2026-69201](https://cve.now/CVE-2026-69201.md): Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (CVSS 5.9, http4s · org.http4s:http4s-server\_2.12 +2)
- [CVE-2026-69216](https://cve.now/CVE-2026-69216.md): Http4s: Ember chunk parser lenience (TE.TE request smuggling) (CVSS 5.4, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69208](https://cve.now/CVE-2026-69208.md): Http4s: DigestAuth nonce map grows unbounded (CVSS 7.5, http4s · org.http4s:http4s-ember-server\_2.12 +2)
- [CVE-2026-69204](https://cve.now/CVE-2026-69204.md): Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (CVSS 9.2, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-55225](https://cve.now/CVE-2026-55225.md): Strimzi: Cross-namespace privilege escalation via \`Kafka.spec.entityOperator\` (CVSS 8.0, strimzi-kafka-operator · io.strimzi:strimzi)
- [CVE-2026-55226](https://cve.now/CVE-2026-55226.md): Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator (CVSS 5.4, strimzi-kafka-operator · io.strimzi:strimzi)
- [CVE-2026-54251](https://cve.now/CVE-2026-54251.md): netty-incubator-codec-ohttp: \[OHttpServerCodec\] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (CVSS 8.7, netty-incubator-codec-ohttp · io.netty.incubator netty-i… +1)
- [CVE-2026-54050](https://cve.now/CVE-2026-54050.md): Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image (CVSS 6.5, sakaiproject sakai · org.sakaiproject.profile2:profile2-… +1)
- [CVE-2026-55864](https://cve.now/CVE-2026-55864.md): GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool (CVSS 7.8, core-geonetwork · org.geonetwork-opensource:gn-web-app)
- [CVE-2026-65831](https://cve.now/CVE-2026-65831.md): ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (CVSS 7.7, ArcadeData arcadedb · com.arcadedb arcadedb-server +1)
- [CVE-2026-54077](https://cve.now/CVE-2026-54077.md): ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (CVSS 7.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1)
- [CVE-2026-54076](https://cve.now/CVE-2026-54076.md): ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (CVSS 8.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1)
- [CVE-2026-53966](https://cve.now/CVE-2026-53966.md): XWiki Platform: Privilege escalation from edit to script right through Live Data editing (CVSS 7.1, xwiki-platform · org.xwiki.platform:xwiki-platform-livedata…)
- [CVE-2026-46495](https://cve.now/CVE-2026-46495.md): OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI (CVSS 9.2, OpenIdentityPlatform OpenDJ · org.openidentityplatform.o… +1)
- [CVE-2026-48722](https://cve.now/CVE-2026-48722.md): Nextflow: Incorrect default permissions in the nextflow auth login command (CVSS 5.5, nextflow-io nextflow · io.nextflow:nextflow)
- [CVE-2026-48717](https://cve.now/CVE-2026-48717.md): OpenAM OAuth Authorization Bypass via PKCE Challenge (CVSS 9.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-47426](https://cve.now/CVE-2026-47426.md): OpenAM OAuth Client Impersonation via JWKS Resolver Cache (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-47424](https://cve.now/CVE-2026-47424.md): OpenAM Authenticated RCE via Groovy Sandbox Escape (CVSS 7.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-41573](https://cve.now/CVE-2026-41573.md): OpenAM LDAP Injection via \`\_queryId\` Parameter (CVSS 7.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62280](https://cve.now/CVE-2026-62280.md): OpenAM Reflected XSS in the OAuth2/OIDC \`wap\` consent page (CVSS 6.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45051](https://cve.now/CVE-2026-45051.md): OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62263](https://cve.now/CVE-2026-62263.md): OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth\>1 bypass (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46623](https://cve.now/CVE-2026-46623.md): OpenAM Account Takeover via Unverified Password Change in OAuth2 Module (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46619](https://cve.now/CVE-2026-46619.md): OpenAM Authentication Bypass via MSISDN LDAP Injection (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46498](https://cve.now/CVE-2026-46498.md): OpenAM Arbitrary OAuth Token Minting via Push Registration (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45794](https://cve.now/CVE-2026-45794.md): OpenAM Unsafe Java Deserialization via SNS (CVSS 7.7, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45048](https://cve.now/CVE-2026-45048.md): OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC (CVSS 8.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44203](https://cve.now/CVE-2026-44203.md): OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response\_mode=form\_post via state parameter (FormPostResponse.ftl) (CVSS 8.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44202](https://cve.now/CVE-2026-44202.md): OpenAM Authenticated Server-Side Request Forgery (SSRF) via \`/sessionservice\` (CVSS 5.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62379](https://cve.now/CVE-2026-62379.md): OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback (CVSS 9.8, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-53660](https://cve.now/CVE-2026-53660.md): OpenAM Insecure SSO Cookie Initialization (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45052](https://cve.now/CVE-2026-45052.md): OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44793](https://cve.now/CVE-2026-44793.md): OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via \`FSUtils.postToTarget\` (CVSS 7.0, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-73494](https://cve.now/CVE-2026-73494.md): blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser (CVSS 7.4, http4s blaze · org.http4s blaze-http\_2.13 +5)
- [CVE-2026-53752](https://cve.now/CVE-2026-53752.md): docx4j: Stack Overflow via Cyclic \`w:basedOn\` Style Chain leads to Denial of Service (CVSS 7.5, plutext docx4j · org.docx4j docx4j-core +1)
- [CVE-2026-53659](https://cve.now/CVE-2026-53659.md): http4k: Unbounded gzip decompression in \`ServerFilters.GZip\` / \`RequestFilters.GunZip\` allowed memory-exhaustion DoS (CVSS 7.5, http4k · org.http4k:http4k-core)
- [CVE-2026-55847](https://cve.now/CVE-2026-55847.md): Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering (CVSS 6.1, allure-framework allure2 · io.qameta.allure allure-gener… +1)
- [CVE-2026-55846](https://cve.now/CVE-2026-55846.md): Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read (CVSS 6.2, allure-framework allure2 · io.qameta.allure:allure-commandl…)
- [CVE-2026-34151](https://cve.now/CVE-2026-34151.md): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ (CVSS 8.2, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2026-50270](https://cve.now/CVE-2026-50270.md): dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-java · com.datadoghq dd-java-agent +1)
- [CVE-2026-49439](https://cve.now/CVE-2026-49439.md): OpenRemote read-only asset users can write predicted datapoints (CVSS 4.3, openremote · io.openremote:openremote-manager)
- [CVE-2026-49464](https://cve.now/CVE-2026-49464.md): NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak (CVSS 8.1, nl-portal-backend-libraries · nl.nl-portal:taak)
- [CVE-2026-49463](https://cve.now/CVE-2026-49463.md): NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries (CVSS 6.5, nl.nl-portal:besluiten · nl.nl-portal:documenten-api)
- [CVE-2026-68497](https://cve.now/CVE-2026-68497.md): jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service (CVSS 7.5, FasterXML jackson-databind · tools.jackson.core:jackson-… +1)
- [CVE-2026-84939](https://cve.now/CVE-2026-84939.md): Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks (CVSS 9.1, Apache Software Foundation Apache FreeMarker · org.freemark…)
- [CVE-2026-86597](https://cve.now/CVE-2026-86597.md): Sensitive information written to logs by Snowflake drivers (CVSS 6.5, Snowflake Connector for Python · Snowflake Go Driver +11)
- [CVE-2026-49832](https://cve.now/CVE-2026-49832.md): DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN (CVSS 8.0, DSpace · org.dspace:dspace-api)
- [CVE-2026-49833](https://cve.now/CVE-2026-49833.md): DSpace: Path Traversal possible in LDN message generation (CVSS 5.5, DSpace · org.dspace:dspace-api)
- [CVE-2026-49831](https://cve.now/CVE-2026-49831.md): DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) (CVSS 5.5, DSpace · org.dspace:dspace-api)
- [CVE-2026-49830](https://cve.now/CVE-2026-49830.md): DSpace: ORE resource URI does not validate scheme for non-web resources (CVSS 4.4, DSpace · org.dspace:dspace-api)
- [CVE-2026-32773](https://cve.now/CVE-2026-32773.md): Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (CVSS 6.1, Apache Software Foundation Apache Spark · pyspark +2)
- [CVE-2026-83557](https://cve.now/CVE-2026-83557.md): jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types (CVSS 5.6, FasterXML jackson-databind · tools.jackson.core:jackson-… +1)
- [CVE-2026-84218](https://cve.now/CVE-2026-84218.md): Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix) (CVSS 8.1, Red Hat AMQ Broker · Red Hat build of Apache Camel 4 for… +4)
- [CVE-2026-19032](https://cve.now/CVE-2026-19032.md): jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path (CVSS 5.3, FasterXML jackson-databind · tools.jackson.core:jackson-… +1)
- [CVE-2026-55860](https://cve.now/CVE-2026-55860.md): MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport) (CVSS 5.9, mariadb-corporation mariadb-connector-r2dbc · org.mariad… +1)
- [CVE-2026-55859](https://cve.now/CVE-2026-55859.md): MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb (CVSS 5.9, mariadb-corporation mariadb-connector-r2dbc · org.mariad… +1)
- [CVE-2026-55858](https://cve.now/CVE-2026-55858.md): MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55857](https://cve.now/CVE-2026-55857.md): MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55856](https://cve.now/CVE-2026-55856.md): MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55848](https://cve.now/CVE-2026-55848.md): mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types (CVSS 8.6, mapfish-print · org.mapfish.print.print-lib +4)
- [CVE-2026-55867](https://cve.now/CVE-2026-55867.md): Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens (CVSS 5.3, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55841](https://cve.now/CVE-2026-55841.md): Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message (CVSS 7.5, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55673](https://cve.now/CVE-2026-55673.md): PowSyBl: Command Injection in LocalCommandExecutor-s (CVSS 7.1, powsybl-core · com.powsybl:powsybl-computation-local)
- [CVE-2026-55425](https://cve.now/CVE-2026-55425.md): Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields (CVSS 5.0, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55566](https://cve.now/CVE-2026-55566.md): Yamcs: DOM XSS in Extension Routing (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55565](https://cve.now/CVE-2026-55565.md): Yamcs: Authenticated remote code execution via unescaped StreamSQL \`LIKE\` pattern compiled by Janino (\`LikeExpression\`) (CVSS 9.9, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55559](https://cve.now/CVE-2026-55559.md): Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) (CVSS 9.8, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55552](https://cve.now/CVE-2026-55552.md): Yamcs: Unauthenticated Directory Traversal (CVSS 7.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55549](https://cve.now/CVE-2026-55549.md): Yamcs: Reflected XSS in the URL of the Authorize Endpoint (CVSS 6.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55547](https://cve.now/CVE-2026-55547.md): Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55545](https://cve.now/CVE-2026-55545.md): Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce (CVSS 6.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55521](https://cve.now/CVE-2026-55521.md): Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API (CVSS 8.8, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55511](https://cve.now/CVE-2026-55511.md): Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs \`executeSql\` (CVSS 9.1, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-47892](https://cve.now/CVE-2026-47892.md): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (CVSS 9.8, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-47890](https://cve.now/CVE-2026-47890.md): Spring Framework Server Sent Event stream corruption while rendering fragments (CVSS 9.8, Spring Framework · org.springframework:spring-webflux +1)
- [CVE-2026-47884](https://cve.now/CVE-2026-47884.md): Spring Framework Improper Path Limitation in XsltView (CVSS 9.8, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2026-54550](https://cve.now/CVE-2026-54550.md): IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries (CVSS 7.4, izpack · org.codehaus.izpack:izpack-installer)
- [CVE-2026-54556](https://cve.now/CVE-2026-54556.md): Http4s: HTTP/2 Denial of Service with Ember Backend (CVSS 8.2, http4s · org.http4s http4s-ember-core\_2.12 +5)
- [CVE-2026-68525](https://cve.now/CVE-2026-68525.md): Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (CVSS 9.1, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-65905](https://cve.now/CVE-2026-65905.md): Apache Tomcat: Limited replay attack possible with DIGEST authentication (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-65637](https://cve.now/CVE-2026-65637.md): Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2026-65182](https://cve.now/CVE-2026-65182.md): Apache Tomcat: Bypass longest prefix security constraint (CVSS 9.1, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2026-77310](https://cve.now/CVE-2026-77310.md): jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514) (CVSS 5.3, com.fasterxml.jackson.core:jackson-databind · FasterXML… +1)
- [CVE-2026-78329](https://cve.now/CVE-2026-78329.md): Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-71300](https://cve.now/CVE-2026-71300.md): Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection (CVSS 9.8, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-63621](https://cve.now/CVE-2026-63621.md): Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy (CVSS 5.3, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-66908](https://cve.now/CVE-2026-66908.md): Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted (CVSS 7.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-66907](https://cve.now/CVE-2026-66907.md): Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result (CVSS 7.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-66906](https://cve.now/CVE-2026-66906.md): Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir (CVSS 9.1, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-60093](https://cve.now/CVE-2026-60093.md): Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir (CVSS 5.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-59230](https://cve.now/CVE-2026-59230.md): Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled (CVSS 6.5, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2026-76904](https://cve.now/CVE-2026-76904.md): GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (CVSS 9.8, geotools · org.geotools.jdbc:gt-jdbc-postgis)
- [CVE-2026-75140](https://cve.now/CVE-2026-75140.md): jsoup Uncontrolled Resource Consumption in XmlTreeBuilder (CVSS 8.7, jhy soup · org.jsoup:jsoup)
- [CVE-2026-63490](https://cve.now/CVE-2026-63490.md): Handlebars.java: Arbitrary file read in \`SpringTemplateLoader\` via URL-fragment suffix bypass (CVSS 7.5, jknack handlebars.java · com.github.jknack:handlebars-sprin…)
- [CVE-2026-75595](https://cve.now/CVE-2026-75595.md): Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVSS 9.1, netty · io.netty:netty-handler)
- [CVE-2026-75596](https://cve.now/CVE-2026-75596.md): Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing (CVSS 8.7, netty · io.netty:netty-handler)
- [CVE-2026-18963](https://cve.now/CVE-2026-18963.md): Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass (CVSS 9.1, Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2)
- [CVE-2026-61634](https://cve.now/CVE-2026-61634.md): RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame\_max (CVSS 0.0, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2026-63336](https://cve.now/CVE-2026-63336.md): RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM (CVSS 5.1, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2026-63337](https://cve.now/CVE-2026-63337.md): RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading (CVSS 7.5, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2026-53434](https://cve.now/CVE-2026-53434.md): Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (CVSS 9.1, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2026-9083](https://cve.now/CVE-2026-9083.md): Keycloak: keycloak: information disclosure through arbitrary filesystem path probing (CVSS 4.9, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9799](https://cve.now/CVE-2026-9799.md): Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass (CVSS 4.6, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9705](https://cve.now/CVE-2026-9705.md): Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9086](https://cve.now/CVE-2026-9086.md): Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass (CVSS 7.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9800](https://cve.now/CVE-2026-9800.md): Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison (CVSS 8.1, Red Hat build of Keycloak · Red Hat build of Quarkus 3.2… +6)
- [CVE-2026-29000](https://cve.now/CVE-2026-29000.md): pac4j-jwt JwtAuthenticator Authentication Bypass (CVSS 9.3, pac4j-jwt · org.pac4j:pac4j-jwt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/maven
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.