Threats affecting pkg:maven/core

OpenRemote core versions before 1.32.2 have an improper authorization vulnerability allowing realm administrators to access and modify global resources without super administrator checks. This flaw enables attackers to change the global keycloakUrl, potentially redirecting authentication flows for credential phishing, injecting malicious CSS, replacing map tiles, and deleting logs.

OpenRemote core versions before 1.32.2 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with write:admin permissions can upload HTML or SVG files containing malicious JavaScript via the Manager configuration file upload endpoint. These files can then be accessed through an unauthenticated image retrieval endpoint that serves them with text/html or image/svg+xml content types, leading to script execution in the context of the application origin.

OpenRemote core versions before 1.31.0 contain an authorization bypass vulnerability where inbound edge gateway events do not enforce realm or gateway-descendant authorization. This allows an attacker controlling a registered gateway to manipulate event asset IDs and potentially overwrite or delete assets across different realms, violating tenant isolation.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows authenticated users to access gateway tunnel information from other realms. This flaw enables attackers to retrieve internal gateway details such as target hosts, ports, and routing data by exploiting the getGatewayActiveTunnelInfos endpoint with manipulated realm and gateway ID parameters. The vulnerability is fixed in version 1.31.0.

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

CVE-2026-101386 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2, reflecting limited confidentiality and integrity impacts. Exploitation is considered difficult due to the required conditions.

CVE-2026-101384 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to certain data within Oracle REST Data Services. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 5.0, indicating a medium severity issue. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.

CVE-2026-101383 is a vulnerability in Oracle REST Data Services versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data, requiring user interaction from a third party. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on confidentiality and integrity.

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.  Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

CVE-2026-76646 is a high-severity vulnerability in Apache MyFaces that allows a remote attacker to cause uncontrolled resource consumption by sending specially crafted request parameters. This can lead to a denial of service (DoS) condition. The issue affects multiple versions of Apache MyFaces, and fixed versions have been released. Users are advised to upgrade to the specified fixed versions to mitigate the risk.

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the Multimedia library application introduction component. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official patch or remediation information is provided in the available data.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of the affected application. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.

Silverpeas Core version 6.4.6 contains a Cross Site Scripting (XSS) vulnerability in its Document management file upload feature. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1.

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services: * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG). * Parsing of ISO 19115 metadata in XML format. * Parsing of Coordinate Reference Systems defined in the GML format. * Parsing of files in GPS Exchange Format (GPX). This issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example: java -Djavax.xml.accessExternalDTD="" ...