Skip to content
Fencer Intel

All · maven

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2025-11419 Keycloak: keycloak tls client-initiated renegotiation denial of service
    maven
  2. 4.4
    CVE-2025-62262 Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature
    maven
  3. 5.3
    CVE-2025-62782 InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement
    maven
  4. 5.0
    CVE-2025-62783 InventoryGui affected by item duplication in GUIs which use GuiStorageElement
    maven
  5. 5.4
    CVE-2025-62263 Liferay Portal Vulnerable to Cross-Site Scripting
    maven
  6. 6.1
    CVE-2025-62253 Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
    maven
  7. 5.3
    CVE-2025-61795 Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
    mavenbitnami
    EPSS 1.2% chance of exploitation in 30 days, percentile 69%
  8. 7.5
    CVE-2025-55752 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
    mavenbitnami
    EPSS 64.4% chance of exploitation in 30 days, percentile 99.2%
  9. 9.6
    CVE-2025-55754 Apache Tomcat: console manipulation via escape sequences in log messages
    mavenbitnami
    EPSS 10.3% chance of exploitation in 30 days, percentile 95%
  10. 5.9
    CVE-2025-12194 Bouncy Castle Vulnerable to Uncontrolled Resource Consumption
    maven
  11. 7.5
    CVE-2025-62254 Liferay Portal ComboServlet denial of service via large file combination
    maven
  12. 6.1
    CVE-2025-62255 Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
    maven
  13. 5.4
    CVE-2025-12110 Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed
    maven
  14. 5.4
    CVE-2025-11429 Keycloak-server: too long and not settings compliant session
    maven
  15. 5.3
    CVE-2025-62256 Liferay Portal and DXP do not properly restrict access to OpenAPI
    maven
  16. 6.1
    CVE-2025-60837 MCMS reflected cross-site scripting (XSS) vulnerability
    maven
  17. 5.9
    CVE-2025-62710 Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
    maven
  18. 6.5
    CVE-2025-62247 Liferay Portal and DXP are Missing Authorization in Collection Provider
    maven
  19. 4.8
    CVE-2025-62248 Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
    maven
  20. 7.5
    CVE-2025-11965 Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
    maven
  21. 6.4
    CVE-2025-11966 Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
    maven
  22. 6.1
    CVE-2025-62249 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget
    maven
  23. 6.5
    CVE-2025-62250 Liferay Portal fails to verify messages from the cluster network is trusted
    maven
  24. 7.2
    CVE-2025-57738 Apache Syncope: Remote Code Execution by delegated administrators
    maven
    EPSS 24.2% chance of exploitation in 30 days, percentile 97%
  25. 8.8
    CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
    maven
  26. 5.4
    CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard
    maven
  27. 9.3
    CVE-2025-11849 Mammoth is vulnerable to Directory Traversal
    npmmavenpypinuget
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  28. 9.8
    CVE-2025-56316 MCMS vulnerable SQL injection via the content_title parameter
    maven
  29. 4.3
    CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability
    Springmaven
  30. 7.5
    CVE-2025-41253 Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables
    Springmaven