{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:17:39.853Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "maven" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-107726", "url": "https://cveboard.org/i/cve-2026-107726", "urlPt": "https://cveboard.org/pt/i/cve-2026-107726", "json": "https://cveboard.org/i/cve-2026-107726.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Hazelcast allows arbitrary member memory access by low-privileged client", "summary": "A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member (including Java heap memory, off-heap data, and JVM process address space).", "titlePt": "Hazelcast permite acesso à memória de membro arbitrário por cliente de baixo privilégio", "summaryPt": "Uma falha foi encontrada na Hazelcast Enterprise Edition e Community Edition, que permitiria a um cliente malicioso de baixo privilégio ler dados arbitrários na memória de qualquer membro do cluster (incluindo a memória do heap Java, dados fora do heap e o espaço de endereço do processo JVM).", "affected": [ { "vendor": "hazelcast", "product": "hazelcast", "defaultStatus": "unknown", "versions": [ { "version": "< 5.4.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 5.5.0, < 5.5.10", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 5.6.0, < 5.6.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-09T15:07:22.266Z" }, "fix": "listed", "tags": [ "hazelcast", "maven" ], "cves": [ "CVE-2026-107726" ], "ghsa": "GHSA-6v25-8wq6-xq4j", "cvss": { "score": 9.3, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00383, "percentile": 0.31208, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "maven", "name": "com.hazelcast:hazelcast", "vulnerable": "= 5.6.0", "fixed": "5.7.0", "advisory": "GHSA-6v25-8wq6-xq4j" }, { "ecosystem": "maven", "name": "com.hazelcast:hazelcast", "vulnerable": ">= 5.5.0, < 5.5.10", "fixed": "5.7.0", "advisory": "GHSA-6v25-8wq6-xq4j" }, { "ecosystem": "maven", "name": "com.hazelcast:hazelcast", "vulnerable": "< 5.4.5", "fixed": "5.7.0", "advisory": "GHSA-6v25-8wq6-xq4j" } ], "vendor": "hazelcast", "product": "hazelcast", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-6v25-8wq6-xq4j" } ], "publishedAt": "2026-10-08T22:10:29.000Z", "updatedAt": "2026-10-08T22:10:29.000Z" }, { "id": "cve-2026-107282", "url": "https://cveboard.org/i/cve-2026-107282", "urlPt": "https://cveboard.org/pt/i/cve-2026-107282", "json": "https://cveboard.org/i/cve-2026-107282.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host", "summary": "When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host. Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host.", "titlePt": "AsyncHttpClient: Replay para um host diferente envia a solicitação e as credenciais do host original para o novo host.", "summaryPt": "Quando uma solicitação é repetida em um host diferente, o cliente atualiza apenas a solicitação atual e deixa a solicitação de destino apontando para o host original. Quatro consumidores leem esse valor desatualizado, e cada um envia a solicitação do primeiro host, as credenciais ou ambas para o segundo host.", "affected": [ { "vendor": "AsyncHttpClient", "product": "async-http-client", "defaultStatus": "unknown", "versions": [ { "version": ">= 3.0.0, < 3.0.13", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 2.0.0, < 2.16.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information" }, { "id": "CWE-441", "name": "Unintended Proxy or Intermediary ('Confused Deputy')" }, { "id": "CWE-522", "name": "Insufficiently Protected Credentials" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-10T02:49:45.460Z" }, "fix": "listed", "tags": [ "asynchttpclient", "maven" ], "cves": [ "CVE-2026-107282" ], "ghsa": "GHSA-jmqq-x5g9-9p2w", "cvss": { "score": 9.4, "version": "4.0", "by": "GitHub" }, "epss": { "percentage": 0.00189, "percentile": 0.08055, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "maven", "name": "org.asynchttpclient:async-http-client", "vulnerable": ">= 3.0.0, <= 3.0.12", "fixed": "3.0.13", "advisory": "GHSA-jmqq-x5g9-9p2w" }, { "ecosystem": "maven", "name": "org.asynchttpclient:async-http-client", "vulnerable": ">= 2.0.0, <= 2.16.0", "fixed": "2.16.1", "advisory": "GHSA-jmqq-x5g9-9p2w" } ], "vendor": "AsyncHttpClient", "product": "async-http-client", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-jmqq-x5g9-9p2w" } ], "publishedAt": "2026-10-08T16:30:46.000Z", "updatedAt": "2026-10-08T16:30:46.000Z" }, { "id": "cve-2016-3081", "url": "https://cveboard.org/i/cve-2016-3081", "urlPt": "https://cveboard.org/pt/i/cve-2016-3081", "json": "https://cveboard.org/i/cve-2016-3081.json", "kind": "vuln", "live": false, "knownExploited": true, "severity": "high", "title": "Apache Struts RCE Vulnerability", "summary": "Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.", "titlePt": "Vulnerabilidade de execução remota de código do Apache Struts", "summaryPt": "Apache Struts contém uma vulnerabilidade de injeção de comando que poderia permitir que atacantes remotos executem código arbitrário via method:prefix quando a Invocação Dinâmica de Métodos está habilitada.", "affected": [ { "vendor": "n/a", "product": "n/a", "defaultStatus": "unknown", "versions": [ { "version": "n/a", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://www.exploit-db.com/exploits/39756/", "tag": "exploit" } ], "cwes": [ { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')" } ], "ssvc": { "exploitation": "active", "automatable": "no", "impact": "total", "at": "2026-10-08T00:00:00.000Z" }, "fix": "listed", "tags": [ "apache", "maven" ], "cves": [ "CVE-2016-3081" ], "ghsa": "GHSA-8c6j-ffmf-q6vm", "cvss": { "score": 8.1, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.96052, "percentile": 0.99879, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "maven", "name": "org.apache.struts:struts2-core", "vulnerable": ">= 2.3.19, <= 2.3.20.2", "fixed": "2.3.20.3", "advisory": "GHSA-8c6j-ffmf-q6vm" }, { "ecosystem": "maven", "name": "org.apache.struts:struts2-core", "vulnerable": ">= 2.3.25, <= 2.3.28", "fixed": "2.3.28.1", "advisory": "GHSA-8c6j-ffmf-q6vm" }, { "ecosystem": "maven", "name": "org.apache.struts:struts2-core", "vulnerable": ">= 2.3.21, <= 2.3.24.2", "fixed": "2.3.24.3", "advisory": "GHSA-8c6j-ffmf-q6vm" } ], "vendor": "Apache", "product": "Struts", "kev": { "dateAdded": "2026-10-08", "dueDate": "2026-10-11", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-8c6j-ffmf-q6vm" }, { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081" } ], "publishedAt": "2022-05-14T00:54:14.000Z", "updatedAt": "2026-10-08T00:00:00.000Z" }, { "id": "cve-2026-103922", "url": "https://cveboard.org/i/cve-2026-103922", "urlPt": "https://cveboard.org/pt/i/cve-2026-103922", "json": "https://cveboard.org/i/cve-2026-103922.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path", "summary": "Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path (/_capacitor_http_interceptor_) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed.", "titlePt": "Capacitor Android e iOS: conteúdo remoto pode ser carregado na origem do app via o caminho do proxy HTTP interno", "summaryPt": "O guardião de navegação do WebView do Capacitor validava apenas o host e o esquema de uma URL de destino, não seu caminho. Como o caminho do proxy HTTP interno (/_capacitor_http_interceptor_) é servido na origem do próprio aplicativo, uma navegação de frame para ele era sempre tratada como navegação dentro do app e permitida.", "affected": [ { "vendor": "ionic-team", "product": "capacitor", "defaultStatus": "unknown", "versions": [ { "version": ">= 6.0.0, < 6.2.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 7.0.0, < 7.6.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.0.0, < 8.3.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.3.5, < 8.4.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.5.0, < 8.5.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@capacitor", "product": "android", "defaultStatus": "unknown", "versions": [ { "version": ">= 8.5.0, < 8.5.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.3.5, < 8.4.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.0.0, < 8.3.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 7.0.0, < 7.6.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.2.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "@capacitor", "product": "ios", "defaultStatus": "unknown", "versions": [ { "version": ">= 8.5.0, < 8.5.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.3.5, < 8.4.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.0.0, < 8.3.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 7.0.0, < 7.6.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.2.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "com.capacitorjs", "product": "core", "defaultStatus": "unknown", "versions": [ { "version": ">= 8.5.0, < 8.5.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.3.5, < 8.4.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.0.0, < 8.3.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 7.0.0, < 7.6.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.2.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] }, { "vendor": "swift", "product": "github.com/ionic-team/capacitor-swift-pm", "defaultStatus": "unknown", "versions": [ { "version": ">= 8.5.0, < 8.5.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.3.5, < 8.4.3", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 8.0.0, < 8.3.5", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 7.0.0, < 7.6.9", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 6.0.0, < 6.2.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-346", "name": "Origin Validation Error" }, { "id": "CWE-441", "name": "Unintended Proxy or Intermediary ('Confused Deputy')" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-01T18:01:35.925Z" }, "fix": "listed", "tags": [ "ionic-team", "npm", "swift", "maven" ], "cves": [ "CVE-2026-103922" ], "ghsa": "GHSA-rvm3-566m-v7fv", "cvss": { "score": 9.3, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00213, "percentile": 0.11025, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "npm", "name": "@capacitor/android", "vulnerable": ">= 6.0.0, < 6.2.2", "fixed": "6.2.2", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/android", "vulnerable": ">= 7.0.0, < 7.6.9", "fixed": "7.6.9", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/ios", "vulnerable": ">= 6.0.0, < 6.2.2", "fixed": "6.2.2", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/ios", "vulnerable": ">= 7.0.0, < 7.6.9", "fixed": "7.6.9", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "swift", "name": "github.com/ionic-team/capacitor-swift-pm", "vulnerable": ">= 6.0.0, < 6.2.2", "fixed": "6.2.2", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "swift", "name": "github.com/ionic-team/capacitor-swift-pm", "vulnerable": ">= 7.0.0, < 7.6.9", "fixed": "7.6.9", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "maven", "name": "com.capacitorjs:core", "vulnerable": ">= 6.0.0, < 6.2.2", "fixed": "6.2.2", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "maven", "name": "com.capacitorjs:core", "vulnerable": ">= 7.0.0, < 7.6.9", "fixed": "7.6.9", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/android", "vulnerable": ">= 8.5.0, < 8.5.1", "fixed": "8.5.1", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/ios", "vulnerable": ">= 8.5.0, < 8.5.1", "fixed": "8.5.1", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "swift", "name": "github.com/ionic-team/capacitor-swift-pm", "vulnerable": ">= 8.5.0, < 8.5.1", "fixed": "8.5.1", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "maven", "name": "com.capacitorjs:core", "vulnerable": ">= 8.5.0, < 8.5.1", "fixed": "8.5.1", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "maven", "name": "com.capacitorjs:core", "vulnerable": ">= 8.3.5, < 8.4.3", "fixed": "8.4.3", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/android", "vulnerable": ">= 8.3.5, < 8.4.3", "fixed": "8.4.3", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/ios", "vulnerable": ">= 8.3.5, < 8.4.3", "fixed": "8.4.3", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "swift", "name": "github.com/ionic-team/capacitor-swift-pm", "vulnerable": ">= 8.3.5, < 8.4.3", "fixed": "8.4.3", "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "swift", "name": "github.com/ionic-team/capacitor-swift-pm", "vulnerable": ">= 8.0.0, <= 8.3.4", "fixed": null, "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "maven", "name": "com.capacitorjs:core", "vulnerable": ">= 8.0.0, <= 8.3.4", "fixed": null, "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/android", "vulnerable": ">= 8.0.0, <= 8.3.4", "fixed": null, "advisory": "GHSA-rvm3-566m-v7fv" }, { "ecosystem": "npm", "name": "@capacitor/ios", "vulnerable": ">= 8.0.0, <= 8.3.4", "fixed": null, "advisory": "GHSA-rvm3-566m-v7fv" } ], "vendor": "ionic-team", "product": "capacitor", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rvm3-566m-v7fv" } ], "publishedAt": "2026-10-05T22:53:10.000Z", "updatedAt": "2026-10-05T22:53:10.000Z" }, { "id": "cve-2026-61741", "url": "https://cveboard.org/i/cve-2026-61741", "urlPt": "https://cveboard.org/pt/i/cve-2026-61741", "json": "https://cveboard.org/i/cve-2026-61741.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "http4s-scala-xml has an XML External Entity (XXE) processing issue", "summary": "http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.", "titlePt": "http4s-scala-xml tem um problema de processamento de Entidade Externa XML (XXE)", "summaryPt": "http4s-scala-xml fornece instâncias de EntityDecoder[F, scala.xml.Elem] que analisam corpos de mensagens XML. Esses decodificadores usaram um javax.xml.parsers.SAXParserFactory obtido de SAXParserFactory.newInstance sem nenhuma configuração de segurança. Com as configurações padrão do JDK, o analisador resolve declarações DOCTYPE, entidades externas gerais e de parâmetro, e DTDs externas.", "affected": [ { "vendor": "http4s", "product": "http4s-scala-xml", "defaultStatus": "unknown", "versions": [ { "version": "< 0.24.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": ">= 1.0.0-M1, < 1.0.0-M39", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [], "cwes": [ { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-09-29T03:01:50.360Z" }, "fix": "listed", "tags": [ "http4s", "maven" ], "cves": [ "CVE-2026-61741" ], "ghsa": "GHSA-cjx3-73hr-rpw7", "cvss": { "score": 9.3, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.00294, "percentile": 0.20926, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "maven", "name": "org.http4s:http4s-scala-xml_2.12", "vulnerable": "<= 0.24.0", "fixed": "0.24.1", "advisory": "GHSA-cjx3-73hr-rpw7" }, { "ecosystem": "maven", "name": "org.http4s:http4s-scala-xml_2.13", "vulnerable": "<= 0.24.0", "fixed": "0.24.1", "advisory": "GHSA-cjx3-73hr-rpw7" }, { "ecosystem": "maven", "name": "org.http4s:http4s-scala-xml_2.13", "vulnerable": ">= 1.0.0-M1, <= 1.0.0-M38.1", "fixed": "1.0.0-M39", "advisory": "GHSA-cjx3-73hr-rpw7" }, { "ecosystem": "maven", "name": "org.http4s:http4s-scala-xml_3", "vulnerable": "<= 0.24.0", "fixed": "0.24.1", "advisory": "GHSA-cjx3-73hr-rpw7" }, { "ecosystem": "maven", "name": "org.http4s:http4s-scala-xml_3", "vulnerable": ">= 1.0.0-M1, <= 1.0.0-M38.1", "fixed": "1.0.0-M39", "advisory": "GHSA-cjx3-73hr-rpw7" } ], "vendor": "http4s", "product": "http4s-scala-xml", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-cjx3-73hr-rpw7" } ], "publishedAt": "2026-09-24T19:35:16.000Z", "updatedAt": "2026-09-24T19:35:16.000Z" }, { "id": "cve-2026-85724", "url": "https://cveboard.org/i/cve-2026-85724", "urlPt": "https://cveboard.org/pt/i/cve-2026-85724", "json": "https://cveboard.org/i/cve-2026-85724.json", "kind": "vuln", "live": false, "knownExploited": false, "severity": "critical", "title": "Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug", "summary": "moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-authentication, is untrusted. This is a memory-safe JVM: the ceiling is authorization/ACL bypass + denial of service + cross-session integrity, not RCE (I did not find one and do not claim one). Audited at commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, module broker/.", "titlePt": "Moquette: injeção de wildcard Pattern-ACL (bypass de autorização entre inquilinos) mais um cluster DoS remoto não autenticado, um bypass de autorização de mensagem Will e um bug de corrupção durável entre sessões", "summaryPt": "moquette é acessível por clientes MQTT não confiáveis (anônimos por padrão), então cada byte de qualquer cliente, incluindo pré-autenticação, não é confiável. Isso é uma JVM segura para memória: o teto é o bypass de autorização/ACL + negação de serviço + integridade entre sessões, não RCE (não encontrei um e não afirmo um). Auditado no commit da7f719a6bab9829d520b5838e13ea7b1f9be3ef, módulo broker/.", "affected": [ { "vendor": "moquette-io", "product": "moquette", "defaultStatus": "unknown", "versions": [ { "version": "< 0.18.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq", "tag": "exploit" } ], "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization" }, { "id": "CWE-155", "name": "Improper Neutralization of Wildcards or Matching Symbols" } ], "ssvc": { "exploitation": "poc", "automatable": "no", "impact": "total", "at": "2026-09-24T14:18:56.863Z" }, "fix": "listed", "tags": [ "moquette-io", "maven" ], "cves": [ "CVE-2026-85724" ], "ghsa": "GHSA-5f42-97gr-vfhq", "cvss": { "score": 9.6, "version": "3.1", "by": "GitHub" }, "epss": { "percentage": 0.0027, "percentile": 0.18226, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [ { "ecosystem": "maven", "name": "io.moquette:moquette-broker", "vulnerable": "<= 0.18.0", "fixed": "0.18.1", "advisory": "GHSA-5f42-97gr-vfhq" } ], "vendor": "moquette-io", "product": "moquette", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-5f42-97gr-vfhq" } ], "publishedAt": "2026-09-23T16:11:18.000Z", "updatedAt": "2026-09-23T16:11:18.000Z" } ], "tag": { "tag": "maven", "name": "Maven", "kev": null } }