CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered potentially compromised. As a mitigation, both compromised keys have been revoked so that no future use of the keys are possible. Note, that the published artifacts in Maven Central under the group id net.sourceforge.pmd are not compromised and the signatures are valid.

• CWE-200
• CWE-312
• CWE-540

• https://github.com/pmd/pmd-designer/commit/1548f5f27ba2981b890827fecbd0612fa70a0362
• https://github.com/pmd/pmd-designer/commit/e87a45312753ec46b3e5576c6f6ac1f7de2f5891
• https://github.com/pmd/pmd/security/advisories/GHSA-88m4-h43f-wx84

Published

Jan 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2321A vulnerability was found in 274056675 springboot-openai-cha…6.5
• CVE-2025-23210phpoffice/phpspreadsheet is a pure PHP library for reading a…4.8
• CVE-2025-23211Tandoor Recipes is an application for managing recipes, plan…9.9
• CVE-2025-23212Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2025-23213Tandoor Recipes is an application for managing recipes, plan…5.4
• CVE-2025-23214Cosmos provides users the ability self-host a home server by…6.9
• CVE-2025-23216Argo CD is a declarative, GitOps continuous delivery tool fo…6.8
• CVE-2025-23217mitmproxy is a interactive TLS-capable intercepting HTTP pro…8.2
• CVE-2025-23218WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-23219WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-2322A vulnerability was found in 274056675 springboot-openai-cha…9.8
• CVE-2025-23220WeGIA is an open source web manager with a focus on the Port…9.8