Every CVE Search/ Get API key

CVE-2025-48734

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

8.8 HighPublic exploitFix available

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.02%Up 1.8 points since May 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.8

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-03
EUVDEUVD-2025-16219 8.8

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
EUVD-2025-16219
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-wxr5-93ph-8wr9 8.8

Apache Commons Improper Access Control vulnerability

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
GHSA-wxr5-93ph-8wr9
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
NVD 8.8

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-04
OSV 8.8

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-48734 8.8

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
DEBIAN-CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-04
Show 47 moreShow less
OSVGHSA-wxr5-93ph-8wr9 8.8

Apache Commons Improper Access Control vulnerability

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
GHSA-wxr5-93ph-8wr9
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSVOESA-2025-1715 8.8

apache-commons-beanutils security update

The scope of this package is to create a package of Java utility methods for accessing and modifying the properties of arbitrary JavaBeans. No dependencies outside of the JDK are required, so the use of this package is very lightweight.

Security Fix(es):

A vulnerability, which was classified as critical, was found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1.CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 1.11.0 or 2.0.0-M2 eliminates this vulnerability.(CVE-2025-48734)

Record
OESA-2025-1715
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1803 8.8

apache-commons-beanutils security update

The scope of this package is to create a package of Java utility methods for accessing and modifying the properties of arbitrary JavaBeans. No dependencies outside of the JDK are required, so the use of this package is very lightweight.

Security Fix(es):

A vulnerability, which was classified as critical, was found in Apache Commons BeanUtils up to 1.10.x/2.0.0-/1.CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 1.11.0 or 2.0.0-M2 eliminates this vulnerability.(CVE-2025-48734)

Record
OESA-2025-1803
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-1a7bd97b99988e1c 8.8

Lightwell Security Advisory: commons-beanutils 1.10.1.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.10.1.rhlw-00001 with a backported security fix.

CVE-2025-48734: Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

This patched artifact is a drop-in replacement for commons-beanutils:commons-beanutils 1.10.1 from Maven Central.

Record
RHLW-2026-1a7bd97b99988e1c
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-89f4dbc7818c5084 8.8

Lightwell Security Advisory: commons-beanutils 1.10.0.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.10.0.rhlw-00001 with a backported security fix.

CVE-2025-48734: Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

This patched artifact is a drop-in replacement for commons-beanutils:commons-beanutils 1.10.0 from Maven Central.

Record
RHLW-2026-89f4dbc7818c5084
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHLW-2026-be2f564b0bee4a36 8.8

Lightwell Security Advisory: commons-beanutils 1.9.4.rhlw-00001

Red Hat Lightwell has released commons-beanutils:commons-beanutils 1.9.4.rhlw-00001 with a backported security fix.

CVE-2025-48734: Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

This patched artifact is a drop-in replacement for commons-beanutils:commons-beanutils 1.9.4 from Maven Central.

Record
RHLW-2026-be2f564b0bee4a36
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10452 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update

Record
RHSA-2025:10452
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10453 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update

Record
RHSA-2025:10453
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10814 8.8

Red Hat Security Advisory: apache-commons-beanutils security update

Record
RHSA-2025:10814
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10924 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update

Record
RHSA-2025:10924
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10925 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update

Record
RHSA-2025:10925
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:10926 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update

Record
RHSA-2025:10926
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15810 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update

Record
RHSA-2025:15810
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15811 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update

Record
RHSA-2025:15811
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15812 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update

Record
RHSA-2025:15812
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15813 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update

Record
RHSA-2025:15813
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15814 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update

Record
RHSA-2025:15814
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15815 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update

Record
RHSA-2025:15815
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15816 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update

Record
RHSA-2025:15816
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:15817 8.8

Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Record
RHSA-2025:15817
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:16667 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.15 security update

Record
RHSA-2025:16667
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:16668 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.12 on RHEL 7 security update

Record
RHSA-2025:16668
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9114 8.8

Red Hat Security Advisory: apache-commons-beanutils security update

Record
RHSA-2025:9114
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9115 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update

Record
RHSA-2025:9115
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9166 8.8

Red Hat Security Advisory: apache-commons-beanutils security update

Record
RHSA-2025:9166
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9318 8.8

Red Hat Security Advisory: javapackages-tools:201801 security update

Record
RHSA-2025:9318
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:9696 8.8

Red Hat Security Advisory: apache-commons-beanutils security update

Record
RHSA-2025:9696
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:9114 8.8

Important: apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es):

  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9114
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:9166 8.8

Important: apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es):

  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9166
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:9318 8.8

Important: javapackages-tools:201801 security update

The javapackages-tools packages provide macros and scripts to support Java packaging.

Security Fix(es):

  • apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)

  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9318
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-48734 8.8

CVE-2025-48734 in commons-beanutils:commons-beanutils - Patched by Root

Root has patched CVE-2025-48734 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-48734 8.8

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
UBUNTU-CVE-2025-48734
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2025:9114 No score

Important: apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es):

  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9114
Updated
2026-11-02
OSVALSA-2025:9166 No score

Important: apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es):

  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9166
Updated
2026-11-02
OSVALSA-2025:9318 No score

Important: javapackages-tools:201801 security update

The javapackages-tools packages provide macros and scripts to support Java packaging.

Security Fix(es):

  • apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)
  • commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9318
Updated
2026-11-02
OSVAZL-109472 No score

CVE-2025-48734 affecting package apache-commons-beanutils 1.9.4-5

Improper Access Control vulnerability in Apache Commons.

A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.

Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

1.x are recommended to upgrade to version 1.11.0, which fixes the issue.

Users of the artifact org.apache.commons:commons-beanutils2

2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Record
AZL-109472
Updated
2026-11-05
OSVCLSA-2025-1754006614 No score

TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.4-tuxcare.1.

Record
CLSA-2025-1754006614
Updated
2026-11-02
OSVCLSA-2026-1775781177 No score

TuxCare security update for commons-beanutils:commons-beanutils (2 CVEs)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 2 CVEs. Fixed in 1.6-tuxcare.1.

Record
CLSA-2026-1775781177
Updated
2026-11-02
OSVCLSA-2026-1780361388 No score

TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.3-tuxcare.2.

Record
CLSA-2026-1780361388
Updated
2026-11-02
OSVCLSA-2026-1782435541 No score

TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.0-tuxcare.2.

Record
CLSA-2026-1782435541
Updated
2026-11-02
OSVCLSA-2026-1784077478 No score

TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.1-tuxcare.1.

Record
CLSA-2026-1784077478
Updated
2026-11-02
OSVCLSA-2026-1787913021 No score

TuxCare security update for org.apache.ant (1 CVE)

TuxCare rebuilt 23 org.apache.ant packages to address 1 CVE. Fixed in 1.9.4-tuxcare.1.

Record
CLSA-2026-1787913021
Updated
2026-11-02
OSVCLSA-2026-1788757915 No score

TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1.

Record
CLSA-2026-1788757915
Updated
2026-11-02
OSVCLSA-2026-1789363246 No score

TuxCare security update for commons-configuration:commons-configuration (2 CVEs)

TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1.

Record
CLSA-2026-1789363246
Updated
2026-11-02
OSVCLSA-2026-1791878536 No score

TuxCare security update for commons-beanutils:commons-beanutils (3 CVEs)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 3 CVEs. Fixed in 1.9.3-tuxcare.1.

Record
CLSA-2026-1791878536
Updated
2026-11-02
OSVMGASA-2025-0299 No score

Updated apache-commons-beanutils packages fix security vulnerability

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default. (CVE-2025-48734)

Record
MGASA-2025-0299
Updated
2026-11-02
OSVopenSUSE-SU-2025:15175-1 No score

apache-commons-beanutils-1.11.0-1.1 on GA media

These are all security issues fixed in the apache-commons-beanutils-1.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15175-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
commons-beanutils:commons-beanutils
Maven
 1.0 to 1.10.1
1.11.0
org.apache.commons:commons-beanutils2
Maven
 2.0.0-M1 up to 2.0.0-M2
2.0.0-M2
apache-commons-beanutils
AlmaLinux:9
 before 1.9.4-10.el9_6
1.9.4-10.el9_6
apache-commons-beanutils
AlmaLinux:10
 before 1.9.4-21.el10_0
1.9.4-21.el10_0
apache-commons-beanutils-javadoc
AlmaLinux:10
 before 1.9.4-21.el10_0
1.9.4-21.el10_0
ant
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-antlr
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-bcel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-bsf
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-log4j
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
Show 290 moreShow less
Affected packages
PackageAffectedFixed
ant-apache-oro
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-regexp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-resolver
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-apache-xalan2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-commons-logging
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-commons-net
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-contrib
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0-0.32.b3.module_el8.0.0+6004+2fc32706
1.0-0.32.b3.module_el8.0.0+6004+2fc32706
ant-contrib-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0-0.32.b3.module_el8.0.0+6004+2fc32706
1.0-0.32.b3.module_el8.0.0+6004+2fc32706
ant-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-javamail
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-jdepend
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-jmf
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-jsch
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-junit
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-lib
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-manual
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-swing
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-testutil
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
ant-xz
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.10.5-1.module_el8.0.0+6004+2fc32706
1.10.5-1.module_el8.0.0+6004+2fc32706
antlr-C++
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.0.0+6004+2fc32706
2.7.7-56.module_el8.0.0+6004+2fc32706
antlr-C++
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.5.0+197+0c7f4e0a
2.7.7-56.module_el8.5.0+197+0c7f4e0a
antlr-C++
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.6.0+3182+f8468cf8
2.7.7-56.module_el8.6.0+3182+f8468cf8
antlr-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.0.0+6004+2fc32706
2.7.7-56.module_el8.0.0+6004+2fc32706
antlr-manual
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.0.0+6004+2fc32706
2.7.7-56.module_el8.0.0+6004+2fc32706
antlr-tool
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.7.7-56.module_el8.0.0+6004+2fc32706
2.7.7-56.module_el8.0.0+6004+2fc32706
aopalliance
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0-17.module_el8.0.0+6004+2fc32706
1.0-17.module_el8.0.0+6004+2fc32706
aopalliance-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0-17.module_el8.0.0+6004+2fc32706
1.0-17.module_el8.0.0+6004+2fc32706
apache-commons-beanutils
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.9.3-5.module_el8.10.0+4020+7deec6e4
1.9.3-5.module_el8.10.0+4020+7deec6e4
apache-commons-beanutils-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.9.3-5.module_el8.10.0+4020+7deec6e4
1.9.3-5.module_el8.10.0+4020+7deec6e4
apache-commons-cli
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.4-4.module_el8.0.0+6004+2fc32706
1.4-4.module_el8.0.0+6004+2fc32706
apache-commons-cli-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.4-4.module_el8.0.0+6004+2fc32706
1.4-4.module_el8.0.0+6004+2fc32706
apache-commons-codec
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.11-3.module_el8.0.0+6004+2fc32706
1.11-3.module_el8.0.0+6004+2fc32706
apache-commons-codec-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.11-3.module_el8.0.0+6004+2fc32706
1.11-3.module_el8.0.0+6004+2fc32706
apache-commons-collections
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.2.2-10.module_el8.0.0+6004+2fc32706
3.2.2-10.module_el8.0.0+6004+2fc32706
apache-commons-collections-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.2.2-10.module_el8.0.0+6004+2fc32706
3.2.2-10.module_el8.0.0+6004+2fc32706
apache-commons-collections-testframework
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.2.2-10.module_el8.0.0+6004+2fc32706
3.2.2-10.module_el8.0.0+6004+2fc32706
apache-commons-compress
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.18-1.module_el8.0.0+6004+2fc32706
1.18-1.module_el8.0.0+6004+2fc32706
apache-commons-compress-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.18-1.module_el8.0.0+6004+2fc32706
1.18-1.module_el8.0.0+6004+2fc32706
apache-commons-exec
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.3-8.module_el8.0.0+6004+2fc32706
1.3-8.module_el8.0.0+6004+2fc32706
apache-commons-exec-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.3-8.module_el8.0.0+6004+2fc32706
1.3-8.module_el8.0.0+6004+2fc32706
apache-commons-io
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:2.6-3.module_el8.0.0+6004+2fc32706
1:2.6-3.module_el8.0.0+6004+2fc32706
apache-commons-io-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:2.6-3.module_el8.0.0+6004+2fc32706
1:2.6-3.module_el8.0.0+6004+2fc32706
apache-commons-jxpath
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.3-29.module_el8.0.0+6004+2fc32706
1.3-29.module_el8.0.0+6004+2fc32706
apache-commons-jxpath-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.3-29.module_el8.0.0+6004+2fc32706
1.3-29.module_el8.0.0+6004+2fc32706
apache-commons-lang
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.6-21.module_el8.0.0+6004+2fc32706
2.6-21.module_el8.0.0+6004+2fc32706
apache-commons-lang-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.6-21.module_el8.0.0+6004+2fc32706
2.6-21.module_el8.0.0+6004+2fc32706
apache-commons-lang3
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.7-3.module_el8.0.0+6004+2fc32706
3.7-3.module_el8.0.0+6004+2fc32706
apache-commons-lang3-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.7-3.module_el8.0.0+6004+2fc32706
3.7-3.module_el8.0.0+6004+2fc32706
apache-commons-logging
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.2-13.module_el8.0.0+6004+2fc32706
1.2-13.module_el8.0.0+6004+2fc32706
apache-commons-logging-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.2-13.module_el8.0.0+6004+2fc32706
1.2-13.module_el8.0.0+6004+2fc32706
apache-commons-net
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.6-3.module_el8.0.0+6004+2fc32706
3.6-3.module_el8.0.0+6004+2fc32706
apache-commons-net-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.6-3.module_el8.0.0+6004+2fc32706
3.6-3.module_el8.0.0+6004+2fc32706
apache-commons-parent
AlmaLinux:8
From an advisory covering 2 CVEs
 before 43-2.module_el8.0.0+6004+2fc32706
43-2.module_el8.0.0+6004+2fc32706
apache-ivy
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.4.0-14.module_el8.0.0+6004+2fc32706
2.4.0-14.module_el8.0.0+6004+2fc32706
apache-ivy-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.4.0-14.module_el8.0.0+6004+2fc32706
2.4.0-14.module_el8.0.0+6004+2fc32706
apache-parent
AlmaLinux:8
From an advisory covering 2 CVEs
 before 19-2.module_el8.0.0+6004+2fc32706
19-2.module_el8.0.0+6004+2fc32706
apache-resource-bundles
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2-20.module_el8.0.0+6004+2fc32706
2-20.module_el8.0.0+6004+2fc32706
aqute-bnd
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.5.0-4.module_el8.0.0+6004+2fc32706
3.5.0-4.module_el8.0.0+6004+2fc32706
aqute-bnd-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.5.0-4.module_el8.0.0+6004+2fc32706
3.5.0-4.module_el8.0.0+6004+2fc32706
aqute-bndlib
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.5.0-4.module_el8.0.0+6004+2fc32706
3.5.0-4.module_el8.0.0+6004+2fc32706
assertj-core
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.8.0-2.module_el8.0.0+6004+2fc32706
3.8.0-2.module_el8.0.0+6004+2fc32706
assertj-core-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.8.0-2.module_el8.0.0+6004+2fc32706
3.8.0-2.module_el8.0.0+6004+2fc32706
atinject
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1-28.20100611svn86.module_el8.0.0+6004+2fc32706
1-28.20100611svn86.module_el8.0.0+6004+2fc32706
atinject-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1-28.20100611svn86.module_el8.0.0+6004+2fc32706
1-28.20100611svn86.module_el8.0.0+6004+2fc32706
atinject-tck
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1-28.20100611svn86.module_el8.0.0+6004+2fc32706
1-28.20100611svn86.module_el8.0.0+6004+2fc32706
bcel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 6.2-2.module_el8.0.0+6004+2fc32706
6.2-2.module_el8.0.0+6004+2fc32706
bcel-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 6.2-2.module_el8.0.0+6004+2fc32706
6.2-2.module_el8.0.0+6004+2fc32706
beust-jcommander
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.71-5.module_el8.0.0+6004+2fc32706
1.71-5.module_el8.0.0+6004+2fc32706
beust-jcommander-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.71-5.module_el8.0.0+6004+2fc32706
1.71-5.module_el8.0.0+6004+2fc32706
bnd-maven-plugin
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.5.0-4.module_el8.0.0+6004+2fc32706
3.5.0-4.module_el8.0.0+6004+2fc32706
bsf
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.4.0-30.module_el8.0.0+6004+2fc32706
2.4.0-30.module_el8.0.0+6004+2fc32706
bsf-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.4.0-30.module_el8.0.0+6004+2fc32706
2.4.0-30.module_el8.0.0+6004+2fc32706
bsh
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.0-13.b6.module_el8.0.0+6004+2fc32706
2.0-13.b6.module_el8.0.0+6004+2fc32706
bsh-javadoc
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.0-13.b6.module_el8.0.0+6004+2fc32706
2.0-13.b6.module_el8.0.0+6004+2fc32706
bsh-manual
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.0-13.b6.module_el8.0.0+6004+2fc32706
2.0-13.b6.module_el8.0.0+6004+2fc32706
apache-commons-beanutils
Azure Linux:3
 through 1.9.4-5 None known
commons-beanutils:commons-beanutils
TuxCare:Maven
 1.9.4 up to 1.9.4-tuxcare.1
1.9.4-tuxcare.1
commons-beanutils:commons-beanutils
TuxCare:Maven
From an advisory covering 2 CVEs
 1.6 up to 1.6-tuxcare.1
1.6-tuxcare.1
commons-beanutils:commons-beanutils
TuxCare:Maven
 1.8.3 up to 1.8.3-tuxcare.2, plus listed versions
1.8.3-tuxcare.1
1.8.3-tuxcare.2
commons-beanutils:commons-beanutils
TuxCare:Maven
 1.8.0 up to 1.8.0-tuxcare.2, plus listed versions
1.8.0-tuxcare.1
1.8.0-tuxcare.2
commons-beanutils:commons-beanutils
TuxCare:Maven
 1.10.1 up to 1.10.1-tuxcare.1
1.10.1-tuxcare.1
commons-beanutils:commons-beanutils
TuxCare:Maven
 1.10.0 up to 1.10.0-tuxcare.1
1.10.0-tuxcare.1
commons-beanutils:commons-beanutils
TuxCare:Maven
From an advisory covering 3 CVEs
 1.9.3 up to 1.9.3-tuxcare.1
1.9.3-tuxcare.1
commons-beanutils
Debian:12
 before 1.9.4-1+deb12u1, plus listed versions
1.9.4-1
1.9.4-1+deb12u1
commons-beanutils
Debian:13
 before 1.10.1-1.1
1.10.1-1.1
commons-beanutils
Debian:14
 before 1.10.1-1.1
1.10.1-1.1
commons-beanutils
Debian:11
 before 1.9.4-1+deb11u1, plus listed versions
1.9.4-1
1.9.4-1+deb11u1
commons-beanutils:commons-beanutils
Maven
 1.0 up to 1.11.0, plus listed versions
1.10.01.10.11.21.31.4
Show 15 moreShow less
1.4.11.51.61.6.11.7.01.8.01.8.0-BETA1.8.11.8.21.8.31.9.01.9.11.9.21.9.31.9.4
1.11.0
apache-commons-beanutils
Mageia:9
 before 1.9.4-7.1.mga9
1.9.4-7.1.mga9
apache-commons-beanutils
openEuler:22.03-LTS-SP3
 before 1.9.4-4.oe2203sp3
1.9.4-4.oe2203sp3
apache-commons-beanutils
openEuler:22.03-LTS-SP4
 before 1.9.4-4.oe2203sp4
1.9.4-4.oe2203sp4
apache-commons-beanutils
openEuler:24.03-LTS
 before 1.9.4-4.oe2403sp1
1.9.4-4.oe2403sp1
apache-commons-beanutils
openEuler:24.03-LTS-SP1
 before 1.9.4-4.oe2403sp1
1.9.4-4.oe2403sp1
apache-commons-beanutils
openEuler:20.03-LTS-SP4
 before 1.9.4-4.oe2003sp4
1.9.4-4.oe2003sp4
apache-commons-beanutils
openEuler:24.03-LTS-SP2
 before 1.9.4-4.oe2403sp2
1.9.4-4.oe2403sp2
commons-beanutils:commons-beanutils
Red Hat Lightwell:Maven
 1.10.1 up to 1.10.1.rhlw-00001
1.10.1.rhlw-00001
commons-beanutils:commons-beanutils
Red Hat Lightwell:Maven
 1.10.0 up to 1.10.0.rhlw-00001
1.10.0.rhlw-00001
commons-beanutils:commons-beanutils
Red Hat Lightwell:Maven
 before 1.9.4.rhlw-00001, plus listed versions
1.01.21.31.41.4.1
Show 14 moreShow less
1.51.61.6.11.7.01.8.01.8.0-BETA1.8.11.8.21.8.31.9.01.9.11.9.21.9.31.9.4
1.9.4.rhlw-00001
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el8eap
0:2.33.0-3.redhat_00017.1.el8eap
eap8-apache-commons-beanutils
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:1.11.0-1.redhat_00001.1.el8eap
0:1.11.0-1.redhat_00001.1.el8eap
eap8-apache-cxf
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el8eap
0:4.0.6-2.redhat_00001.1.el8eap
eap8-apache-cxf-rt
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el8eap
0:4.0.6-2.redhat_00001.1.el8eap
eap8-apache-cxf-services
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el8eap
0:4.0.6-2.redhat_00001.1.el8eap
eap8-apache-cxf-tools
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el8eap
0:4.0.6-2.redhat_00001.1.el8eap
eap8-apache-mime4j
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el8eap
0:0.8.12-1.redhat_00001.1.el8eap
eap8-apache-mime4j-dom
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el8eap
0:0.8.12-1.redhat_00001.1.el8eap
eap8-apache-mime4j-storage
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el8eap
0:0.8.12-1.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:800.8.0-1.GA_redhat_00001.1.el8eap
0:800.8.0-1.GA_redhat_00001.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:800.8.0-1.GA_redhat_00001.1.el8eap
0:800.8.0-1.GA_redhat_00001.1.el8eap
eap8-elytron-web
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.0.3-1.Final_redhat_00001.1.el8eap
0:4.0.3-1.Final_redhat_00001.1.el8eap
eap8-fastinfoset
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.1.1-1.redhat_00001.1.el8eap
0:2.1.1-1.redhat_00001.1.el8eap
eap8-hal-console
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:3.6.24-1.Final_redhat_00001.1.el8eap
0:3.6.24-1.Final_redhat_00001.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.2.36-1.Final_redhat_00001.1.el8eap
0:6.2.36-1.Final_redhat_00001.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.2.36-1.Final_redhat_00001.1.el8eap
0:6.2.36-1.Final_redhat_00001.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.2.36-1.Final_redhat_00001.1.el8eap
0:6.2.36-1.Final_redhat_00001.1.el8eap
eap8-httpcomponents-asyncclient
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:4.1.5-4.redhat_00006.1.el8eap
0:4.1.5-4.redhat_00006.1.el8eap
eap8-jboss-remoting
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:5.0.31-1.Final_redhat_00001.1.el8eap
0:5.0.31-1.Final_redhat_00001.1.el8eap
eap8-jbossws-cxf
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:7.3.3-1.Final_redhat_00001.1.el8eap
0:7.3.3-1.Final_redhat_00001.1.el8eap
eap8-narayana
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-jbosstxbridge
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-jbossxts
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-jts-idlj
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-jts-integration
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-bridge
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-integration
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-util
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:6.0.6-1.Final_redhat_00001.1.el8eap
0:6.0.6-1.Final_redhat_00001.1.el8eap
eap8-neethi
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:3.2.1-1.redhat_00002.1.el8eap
0:3.2.1-1.redhat_00002.1.el8eap
eap8-reactivex-rxjava2
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.2.21-3.redhat_00002.1.el8eap
0:2.2.21-3.redhat_00002.1.el8eap
eap8-slf4j
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.17-1.redhat_00001.1.el8eap
0:2.0.17-1.redhat_00001.1.el8eap
eap8-slf4j-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.0.17-1.redhat_00001.1.el8eap
0:2.0.17-1.redhat_00001.1.el8eap
eap8-velocity
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.3.0-4.redhat_00010.1.el8eap
0:2.3.0-4.redhat_00010.1.el8eap
eap8-velocity-engine-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.3.0-4.redhat_00010.1.el8eap
0:2.3.0-4.redhat_00010.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:8.0.8-4.GA_redhat_00006.1.el8eap
0:8.0.8-4.GA_redhat_00006.1.el8eap
eap8-wildfly-elytron
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.2.11-1.Final_redhat_00001.1.el8eap
0:2.2.11-1.Final_redhat_00001.1.el8eap
eap8-wildfly-elytron-tool
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:2.2.11-1.Final_redhat_00001.1.el8eap
0:2.2.11-1.Final_redhat_00001.1.el8eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:8.0.8-4.GA_redhat_00006.1.el8eap
0:8.0.8-4.GA_redhat_00006.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:8.0.8-4.GA_redhat_00006.1.el8eap
0:8.0.8-4.GA_redhat_00006.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:8.0.8-4.GA_redhat_00006.1.el8eap
0:8.0.8-4.GA_redhat_00006.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 5 CVEs
 before 0:8.0.8-4.GA_redhat_00006.1.el8eap
0:8.0.8-4.GA_redhat_00006.1.el8eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.33.0-3.redhat_00017.1.el9eap
0:2.33.0-3.redhat_00017.1.el9eap
eap8-apache-commons-beanutils
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:1.11.0-1.redhat_00001.1.el9eap
0:1.11.0-1.redhat_00001.1.el9eap
eap8-apache-cxf
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el9eap
0:4.0.6-2.redhat_00001.1.el9eap
eap8-apache-cxf-rt
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el9eap
0:4.0.6-2.redhat_00001.1.el9eap
eap8-apache-cxf-services
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el9eap
0:4.0.6-2.redhat_00001.1.el9eap
eap8-apache-cxf-tools
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:4.0.6-2.redhat_00001.1.el9eap
0:4.0.6-2.redhat_00001.1.el9eap
eap8-apache-mime4j
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el9eap
0:0.8.12-1.redhat_00001.1.el9eap
eap8-apache-mime4j-dom
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el9eap
0:0.8.12-1.redhat_00001.1.el9eap
eap8-apache-mime4j-storage
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:0.8.12-1.redhat_00001.1.el9eap
0:0.8.12-1.redhat_00001.1.el9eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:800.8.0-1.GA_redhat_00001.1.el9eap
0:800.8.0-1.GA_redhat_00001.1.el9eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:800.8.0-1.GA_redhat_00001.1.el9eap
0:800.8.0-1.GA_redhat_00001.1.el9eap
eap8-elytron-web
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:4.0.3-1.Final_redhat_00001.1.el9eap
0:4.0.3-1.Final_redhat_00001.1.el9eap
eap8-fastinfoset
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 5 CVEs
 before 0:2.1.1-1.redhat_00001.1.el9eap
0:2.1.1-1.redhat_00001.1.el9eap
apache-commons-beanutils
Rocky Linux:9
 before 0:1.9.4-10.el9_6
0:1.9.4-10.el9_6
apache-commons-beanutils
Rocky Linux:10
 before 0:1.9.4-21.el10_0
0:1.9.4-21.el10_0
ant
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.10.5-1.module+el8.3.0+74+855e3f5d
0:1.10.5-1.module+el8.3.0+74+855e3f5d
ant
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.10.5-1.module+el8.10.0+2003+8aeac9cb
0:1.10.5-1.module+el8.10.0+2003+8aeac9cb
ant-contrib
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-0.32.b3.module+el8.3.0+74+855e3f5d
0:1.0-0.32.b3.module+el8.3.0+74+855e3f5d
antlr
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.7.7-56.module+el8.3.0+74+855e3f5d
0:2.7.7-56.module+el8.3.0+74+855e3f5d
aopalliance
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-17.module+el8.6.0+843+5a13dac3
0:1.0-17.module+el8.6.0+843+5a13dac3
aopalliance
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-17.module+el8.10.0+2003+8aeac9cb
0:1.0-17.module+el8.10.0+2003+8aeac9cb
aopalliance
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-17.module+el8.3.0+74+855e3f5d
0:1.0-17.module+el8.3.0+74+855e3f5d
apache-commons-beanutils
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.9.3-5.module+el8.10.0+2003+8aeac9cb
0:1.9.3-5.module+el8.10.0+2003+8aeac9cb
apache-commons-cli
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.4-4.module+el8.6.0+843+5a13dac3
0:1.4-4.module+el8.6.0+843+5a13dac3
apache-commons-cli
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.4-4.module+el8.10.0+2003+8aeac9cb
0:1.4-4.module+el8.10.0+2003+8aeac9cb
apache-commons-cli
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.4-4.module+el8.3.0+74+855e3f5d
0:1.4-4.module+el8.3.0+74+855e3f5d
apache-commons-codec
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.11-3.module+el8.6.0+843+5a13dac3
0:1.11-3.module+el8.6.0+843+5a13dac3
apache-commons-codec
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.11-3.module+el8.10.0+2003+8aeac9cb
0:1.11-3.module+el8.10.0+2003+8aeac9cb
apache-commons-codec
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.11-3.module+el8.3.0+74+855e3f5d
0:1.11-3.module+el8.3.0+74+855e3f5d
apache-commons-collections
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.2.2-10.module+el8.10.0+1763+c7c02164
0:3.2.2-10.module+el8.10.0+1763+c7c02164
apache-commons-collections
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.2.2-10.module+el8.3.0+74+855e3f5d
0:3.2.2-10.module+el8.3.0+74+855e3f5d
apache-commons-compress
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.18-1.module+el8.3.0+74+855e3f5d
0:1.18-1.module+el8.3.0+74+855e3f5d
apache-commons-compress
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.18-1.module+el8.10.0+2003+8aeac9cb
0:1.18-1.module+el8.10.0+2003+8aeac9cb
apache-commons-exec
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.3-8.module+el8.3.0+74+855e3f5d
0:1.3-8.module+el8.3.0+74+855e3f5d
apache-commons-io
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:2.6-3.module+el8.6.0+843+5a13dac3
1:2.6-3.module+el8.6.0+843+5a13dac3
apache-commons-io
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:2.6-3.module+el8.3.0+74+855e3f5d
1:2.6-3.module+el8.3.0+74+855e3f5d
apache-commons-io
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:2.6-3.module+el8.10.0+2003+8aeac9cb
1:2.6-3.module+el8.10.0+2003+8aeac9cb
apache-commons-jxpath
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.3-29.module+el8.3.0+74+855e3f5d
0:1.3-29.module+el8.3.0+74+855e3f5d
apache-commons-jxpath
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.3-29.module+el8.10.0+2003+8aeac9cb
0:1.3-29.module+el8.10.0+2003+8aeac9cb
apache-commons-lang
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.6-21.module+el8.10.0+1763+c7c02164
0:2.6-21.module+el8.10.0+1763+c7c02164
apache-commons-lang
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.6-21.module+el8.3.0+74+855e3f5d
0:2.6-21.module+el8.3.0+74+855e3f5d
apache-commons-lang3
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.7-3.module+el8.6.0+843+5a13dac3
0:3.7-3.module+el8.6.0+843+5a13dac3
apache-commons-lang3
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.7-3.module+el8.10.0+2003+8aeac9cb
0:3.7-3.module+el8.10.0+2003+8aeac9cb
apache-commons-lang3
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.7-3.module+el8.3.0+74+855e3f5d
0:3.7-3.module+el8.3.0+74+855e3f5d
apache-commons-logging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-13.module+el8.3.0+133+b8b54b58
0:1.2-13.module+el8.3.0+133+b8b54b58
apache-commons-logging
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-13.module+el8.3.0+74+855e3f5d
0:1.2-13.module+el8.3.0+74+855e3f5d
apache-commons-net
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.6-3.module+el8.10.0+1763+c7c02164
0:3.6-3.module+el8.10.0+1763+c7c02164
apache-commons-net
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.6-3.module+el8.3.0+74+855e3f5d
0:3.6-3.module+el8.3.0+74+855e3f5d
apache-commons-parent
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:43-2.module+el8.3.0+74+855e3f5d
0:43-2.module+el8.3.0+74+855e3f5d
apache-ivy
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.4.0-14.module+el8.3.0+74+855e3f5d
0:2.4.0-14.module+el8.3.0+74+855e3f5d
apache-parent
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:19-2.module+el8.10.0+2003+8aeac9cb
0:19-2.module+el8.10.0+2003+8aeac9cb
apache-parent
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:19-2.module+el8.3.0+74+855e3f5d
0:19-2.module+el8.3.0+74+855e3f5d
apache-resource-bundles
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2-20.module+el8.3.0+74+855e3f5d
0:2-20.module+el8.3.0+74+855e3f5d
aqute-bnd
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.5.0-4.module+el8.3.0+74+855e3f5d
0:3.5.0-4.module+el8.3.0+74+855e3f5d
assertj-core
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.8.0-2.module+el8.3.0+74+855e3f5d
0:3.8.0-2.module+el8.3.0+74+855e3f5d
atinject
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1-28.20100611svn86.module+el8.6.0+843+5a13dac3
0:1-28.20100611svn86.module+el8.6.0+843+5a13dac3
atinject
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1-28.20100611svn86.module+el8.10.0+2003+8aeac9cb
0:1-28.20100611svn86.module+el8.10.0+2003+8aeac9cb
atinject
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1-28.20100611svn86.module+el8.3.0+74+855e3f5d
0:1-28.20100611svn86.module+el8.3.0+74+855e3f5d
bcel
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:6.2-2.module+el8.3.0+74+855e3f5d
0:6.2-2.module+el8.3.0+74+855e3f5d
beust-jcommander
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.71-5.module+el8.3.0+74+855e3f5d
0:1.71-5.module+el8.3.0+74+855e3f5d
bsf
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.4.0-30.module+el8.3.0+74+855e3f5d
0:2.4.0-30.module+el8.3.0+74+855e3f5d
bsh
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.0-13.b6.module+el8.3.0+74+855e3f5d
0:2.0-13.b6.module+el8.3.0+74+855e3f5d
byaccj
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.15-17.module+el8.10.0+2003+8aeac9cb
0:1.15-17.module+el8.10.0+2003+8aeac9cb
byaccj
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.15-17.module+el8.3.0+74+855e3f5d
0:1.15-17.module+el8.3.0+74+855e3f5d
cal10n
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:0.8.1-7.module+el8.3.0+74+855e3f5d
0:0.8.1-7.module+el8.3.0+74+855e3f5d
cdi-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-8.module+el8.6.0+843+5a13dac3
0:1.2-8.module+el8.6.0+843+5a13dac3
cdi-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-8.module+el8.10.0+2003+8aeac9cb
0:1.2-8.module+el8.10.0+2003+8aeac9cb
cdi-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-8.module+el8.3.0+74+855e3f5d
0:1.2-8.module+el8.3.0+74+855e3f5d
cglib
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.2.4-7.module+el8.3.0+74+855e3f5d
0:3.2.4-7.module+el8.3.0+74+855e3f5d
easymock
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.5-4.module+el8.3.0+74+855e3f5d
0:3.5-4.module+el8.3.0+74+855e3f5d
exec-maven-plugin
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.6.0-3.module+el8.3.0+74+855e3f5d
0:1.6.0-3.module+el8.3.0+74+855e3f5d
felix-osgi-compendium
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.4.0-26.module+el8.3.0+74+855e3f5d
0:1.4.0-26.module+el8.3.0+74+855e3f5d
felix-osgi-core
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.4.0-23.module+el8.3.0+74+855e3f5d
0:1.4.0-23.module+el8.3.0+74+855e3f5d
felix-osgi-foundation
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2.0-23.module+el8.3.0+74+855e3f5d
0:1.2.0-23.module+el8.3.0+74+855e3f5d
hawtjni
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.16-2.module+el8.3.0+133+b8b54b58
0:1.16-2.module+el8.3.0+133+b8b54b58
hawtjni
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.16-2.module+el8.3.0+74+855e3f5d
0:1.16-2.module+el8.3.0+74+855e3f5d
felix-parent
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:4-5.module+el8.3.0+74+855e3f5d
0:4-5.module+el8.3.0+74+855e3f5d
felix-utils
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.10.4-2.module+el8.3.0+74+855e3f5d
0:1.10.4-2.module+el8.3.0+74+855e3f5d
forge-parent
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:38-11.module+el8.3.0+74+855e3f5d
0:38-11.module+el8.3.0+74+855e3f5d
fusesource-pom
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.11-3.module+el8.3.0+74+855e3f5d
0:1.11-3.module+el8.3.0+74+855e3f5d
geronimo-annotation
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-23.module+el8.6.0+843+5a13dac3
0:1.0-23.module+el8.6.0+843+5a13dac3
geronimo-annotation
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-23.module+el8.10.0+2003+8aeac9cb
0:1.0-23.module+el8.10.0+2003+8aeac9cb
geronimo-annotation
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0-23.module+el8.3.0+74+855e3f5d
0:1.0-23.module+el8.3.0+74+855e3f5d
geronimo-jms
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.1.1-25.module+el8.3.0+74+855e3f5d
0:1.1.1-25.module+el8.3.0+74+855e3f5d
geronimo-jpa
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.1.1-21.module+el8.3.0+74+855e3f5d
0:1.1.1-21.module+el8.3.0+74+855e3f5d
geronimo-parent-poms
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.6-25.module+el8.3.0+74+855e3f5d
0:1.6-25.module+el8.3.0+74+855e3f5d
glassfish-annotation-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-13.module+el8.3.0+74+855e3f5d
0:1.2-13.module+el8.3.0+74+855e3f5d
glassfish-annotation-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2-13.module+el8.10.0+2003+8aeac9cb
0:1.2-13.module+el8.10.0+2003+8aeac9cb
glassfish-el
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.0.1-0.7.b08.module+el8.6.0+975+c0ed2db8
0:3.0.1-0.7.b08.module+el8.6.0+975+c0ed2db8
glassfish-el
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.0.1-0.7.b08.module+el8.3.0+74+855e3f5d
0:3.0.1-0.7.b08.module+el8.3.0+74+855e3f5d
glassfish-el
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.0.1-0.7.b08.module+el8.10.0+2003+8aeac9cb
0:3.0.1-0.7.b08.module+el8.10.0+2003+8aeac9cb
glassfish-jsp-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.3.2-0.9.b01.module+el8.10.0+2003+8aeac9cb
0:2.3.2-0.9.b01.module+el8.10.0+2003+8aeac9cb
glassfish-jsp-api
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.3.2-0.9.b01.module+el8.3.0+74+855e3f5d
0:2.3.2-0.9.b01.module+el8.3.0+74+855e3f5d
glassfish-legal
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.1-11.module+el8.3.0+74+855e3f5d
0:1.1-11.module+el8.3.0+74+855e3f5d
glassfish-master-pom
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:8-11.module+el8.3.0+74+855e3f5d
0:8-11.module+el8.3.0+74+855e3f5d
commons-beanutils:commons-beanutils
Root:Maven
 before 1.8.3-aikido.1
1.8.3-aikido.11.6-aikido.21.7.0-aikido.21.9.4-aikido.21.8.3-aikido.2
io.root.commons-beanutils:commons-beanutils
Root:Maven
 before 1.9.4-root.io.1
1.9.4-root.io.11.6-root.io.11.8.3-root.io.11.7.0-root.io.11.6-root.io.21.7.0-root.io.21.9.4-root.io.21.8.3-root.io.2
apache-commons-beanutils
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Manager Server 4.3
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Enterprise Storage 7.1
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
openSUSE:Leap 15.6
 before 1.11.0-150200.3.9.1
1.11.0-150200.3.9.1
apache-commons-beanutils
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 3 CVEs
 before 1.11.0-7.3.1
1.11.0-7.3.1
apache-commons-beanutils
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 1.11.0-7.3.1
1.11.0-7.3.1
commons-beanutils
Ubuntu:Pro:14.04:LTS
 before 1.9.1-1ubuntu0.1~esm2, plus listed versions
1.8.3-41.9.0-11.9.1-11.9.1-1ubuntu0.1~esm1
1.9.1-1ubuntu0.1~esm2
commons-beanutils
Ubuntu:Pro:18.04:LTS
 before 1.9.3-1ubuntu0.1~esm2, plus listed versions
1.9.3-11.9.3-1ubuntu0.1~esm1
1.9.3-1ubuntu0.1~esm2
commons-beanutils
Ubuntu:Pro:20.04:LTS
 before 1.9.4-1ubuntu0.20.04.1~esm1, plus listed versions
1.9.4-1
1.9.4-1ubuntu0.20.04.1~esm1
commons-beanutils
Ubuntu:22.04:LTS
 before 1.9.4-1+deb11u1build0.22.04.1, plus listed versions
1.9.4-1
1.9.4-1+deb11u1build0.22.04.1
commons-beanutils
Ubuntu:Pro:24.04:LTS
 before 1.9.4-2ubuntu0.1~esm1, plus listed versions
1.9.4-11.9.4-2
1.9.4-2ubuntu0.1~esm1
commons-beanutils
Ubuntu:Pro:16.04:LTS
 before 1.9.2-3ubuntu0.1~esm1, plus listed versions
1.9.2-11.9.2-21.9.2-3
1.9.2-3ubuntu0.1~esm1
apache-commons-beanutils
openSUSE:Tumbleweed
 before 1.11.0-1.1
1.11.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubh3raklez/CVE-2025-487342026-03-20

History

History
RecordedChangedSources
affectedNVD, OSV
factsCVE List, EUVD
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-48734 is a high vulnerability (CVSS 8.8) in Apache Commons Beanutils, published May 28, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. Fixed in commons-beanutils:commons-beanutils 1.11.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 684 package rows and 12 references. The JSON record has them. Also not on the record: 697 package claims. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 3 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open