Most recent entries from all

ALSA-2026:38500 — Important: maven:3.9 security update

Affected: AlmaLinux:9: aopalliance, AlmaLinux:9: apache-commons-cli, AlmaLinux:9: apache-commons-codec, AlmaLinux:9: apache-commons-io, AlmaLinux:9: atinject, AlmaLinux:9: google-guice, AlmaLinux:9: guava, AlmaLinux:9: httpcomponents-client, AlmaLinux:9: httpcomponents-core, AlmaLinux:9: jakarta-annotations and 22 more

Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information.

Security Fix(es):

* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2026-avi-0381 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0381

Withdrawn: CLEANSTART-2026-AO61361 — Security fixes for CVE-2024-6763, CVE-2025-11143, CVE-2025-12183, CVE-2025-12383, CVE-2025-66566, CVE-2025-67030, CVE-2…

Withdrawn by the publisher.

Affected: CleanStart: kafka-fips

Multiple security vulnerabilities affect the kafka-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-369277

fkie_cve-2025-67030

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

GHSA-6fmv-xxpf-w3cw — Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

Affected: Maven: org.codehaus.plexus:plexus-utils

msrc_CVE-2025-67030 — Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6…

msrc_CVE-2025-67030

openSUSE-SU-2026:10439-1 — plexus-utils-4.0.2-2.1 on GA media

plexus-utils-4.0.2-2.1 on GA media

RHSA-2026:17668 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1 for Spring Boot release.

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corru…

RLSA-2026:38500 — Important: maven:3.9 security update

Affected: Rocky Linux:9: maven, Rocky Linux:9: plexus-utils, Rocky Linux:9: aopalliance, Rocky Linux:9: apache-commons-cli, Rocky Linux:9: apache-commons-codec, Rocky Linux:9: apache-commons-io, Rocky Linux:9: atinject, Rocky Linux:9: google-guice, Rocky Linux:9: guava, Rocky Linux:9: httpcomponents-client and 14 more

Security Fix(es):

* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:21194-1 — Security update for plexus-utils

Security update for plexus-utils

UBUNTU-CVE-2025-67030

Affected: Ubuntu:14.04:LTS: plexus-utils, Ubuntu:14.04:LTS: plexus-utils2, Ubuntu:16.04:LTS: plexus-utils, Ubuntu:16.04:LTS: plexus-utils2, Ubuntu:18.04:LTS: plexus-utils, Ubuntu:18.04:LTS: plexus-utils2, Ubuntu:20.04:LTS: plexus-utils2, Ubuntu:22.04:LTS: plexus-utils2, Ubuntu:24.04:LTS: plexus-utils2, Ubuntu:26.04:LTS: plexus-utils2

WID-SEC-W-2026-1429 — IBM App Connect Enterprise: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise und IBM Integration Bus ausnutzen, um beliebigen Programmcode auszuführen.