Skip to content
Fencer Intel

All · maven

Newest first, late arrivals on top. Also a feed.

  1. 7.8
    CVE-2026-22187 Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files
    maven
  2. 7.1
    CVE-2026-22186 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser
    maven
  3. 7.2
    CVE-2026-22244 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE
    maven
    EPSS 1.3% chance of exploitation in 30 days, percentile 70%
  4. 5.9
    CVE-2025-66560 Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
    maven
  5. 9.6
    CVE-2025-12543 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
    Springmaven
    EPSS 1.3% chance of exploitation in 30 days, percentile 71%
  6. 7.9
    CVE-2025-61916 Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
    maven
  7. 6.5
    CVE-2025-68280 Apache SIS: XML External Entity (XXE) vulnerability
    maven
  8. 8.8
    CVE-2025-66518 Apache Kyuubi: Unauthorized directory access due to missing path normalization
    maven
  9. 4.8
    CVE-2025-15022 Cross-site scripting in Action caption
    maven
  10. 7.5
    CVE-2026-21452 MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation
    maven
  11. 8.1
    CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation
    maven
    EPSS 15.3% chance of exploitation in 30 days, percentile 96%
  12. 8.8
    CVE-2025-66524 Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor
    mavenbitnami
  13. 4.9
    CVE-2025-68390 Elasticsearch Allocation of Resources Without Limits or Throttling
    mavenbitnami
  14. 6.5
    CVE-2025-68384 Elasticsearch Allocation of Resources Without Limits or Throttling
    mavenbitnami
  15. 4.8
    CVE-2025-68161 Apache Log4j Core: Missing TLS hostname verification in Socket appender
    Log4jmaven
  16. 5.3
    CVE-2025-14763 Amazon S3 Encryption Client for Java has a Key Commitment Issue
    maven
  17. 7.5
    CVE-2024-29371 jose4j is vulnerable to DoS via compressed JWE content
    maven
  18. 6.5
    CVE-2025-68113 ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
    npmpackagistgomavenrubygemspypihex
  19. 6.5
    CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
    maven
  20. 6.8
    CVE-2025-37731 Elasticsearch Improper Authentication
    mavenbitnami
  21. 6.3
    CVE-2025-14674 aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection
    maven
  22. 7.5
    CVE-2025-67721 Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
    maven
  23. 5.9
    CVE-2025-53960 Apache StreamPark: Uses the user’s password as the secret key
    maven
  24. 5.3
    CVE-2025-54947 Apache StreamPark: Use hard-coded key vulnerability
    maven
  25. 7.5
    CVE-2025-54981 Apache StreamPark: Weak Encryption Algorithm in StreamPark
    maven
  26. 8.8
    CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability
    maven
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  27. 6.3
    CVE-2025-14518 PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery
    maven
  28. 8.4
    CVE-2025-67505 Race condition in the Okta Java SDK
    maven
  29. 5.3
    CVE-2025-66033 Improper Memory Cleanup in the Okta Java SDK
    maven
  30. 4.3
    CVE-2025-67643 Jenkins Redpen - Pipeline Reporter for Jira Plugin has a path traversal vulnerability
    maven