diff --git a/org.restlet.java/org.restlet.ext.guice/pom.xml b/org.restlet.java/org.restlet.ext.guice/pom.xml
index 32031f6c8a..d6ae2ea19b 100644
--- a/org.restlet.java/org.restlet.ext.guice/pom.xml
+++ b/org.restlet.java/org.restlet.ext.guice/pom.xml
@@ -19,6 +19,22 @@
 			<groupId>com.google.inject</groupId>
 			<artifactId>guice</artifactId>
 			<version>${lib-guice-version}</version>
+			<exclusions>
+				<exclusion><!-- fix CVEs CVE-2023-2976 CVE-2020-8908 -->
+					<groupId>com.google.guava</groupId>
+					<artifactId>guava</artifactId>
+				</exclusion>
+			</exclusions>
+		</dependency>
+		<dependency><!-- fix CVEs CVE-2023-2976 CVE-2020-8908 -->
+			<groupId>com.google.guava</groupId>
+			<artifactId>guava</artifactId>
+			<version>${lib-cves-guava-version}</version>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.inject</groupId>
+			<artifactId>jakarta.inject-api</artifactId>
+			<version>2.0.1</version>
 		</dependency>
 		<dependency>
 			<groupId>org.restlet</groupId>
diff --git a/org.restlet.java/org.restlet.ext.jackson/pom.xml b/org.restlet.java/org.restlet.ext.jackson/pom.xml
index 95424c94c4..01a44c7072 100644
--- a/org.restlet.java/org.restlet.ext.jackson/pom.xml
+++ b/org.restlet.java/org.restlet.ext.jackson/pom.xml
@@ -60,6 +60,16 @@
 			<artifactId>jackson-module-jsonSchema</artifactId>
 			<version>${lib-jackson-version}</version>
 		</dependency>
+		<dependency>
+			<groupId>org.codehaus.woodstox</groupId>
+			<artifactId>stax2-api</artifactId>
+			<version>4.2.2</version>
+		</dependency>
+		<dependency>
+			<groupId>com.fasterxml.woodstox</groupId>
+			<artifactId>woodstox-core</artifactId>
+			<version>7.1.1</version>
+		</dependency>
 		<dependency>
 			<groupId>org.restlet</groupId>
 			<artifactId>org.restlet</artifactId>
diff --git a/org.restlet.java/org.restlet.ext.jetty/pom.xml b/org.restlet.java/org.restlet.ext.jetty/pom.xml
index 1f54c3cede..20a51aaad9 100644
--- a/org.restlet.java/org.restlet.ext.jetty/pom.xml
+++ b/org.restlet.java/org.restlet.ext.jetty/pom.xml
@@ -70,6 +70,26 @@
 			<artifactId>jetty-http3-client-transport</artifactId>
 			<version>${lib-jetty-version}</version>
 		</dependency>
+		<dependency>
+			<groupId>org.eclipse.jetty</groupId>
+			<artifactId>jetty-util</artifactId>
+			<version>${lib-jetty-version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.eclipse.jetty</groupId>
+			<artifactId>jetty-io</artifactId>
+			<version>${lib-jetty-version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.eclipse.jetty</groupId>
+			<artifactId>jetty-http</artifactId>
+			<version>${lib-jetty-version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.eclipse.jetty.quic</groupId>
+			<artifactId>jetty-quic-client</artifactId>
+			<version>${lib-jetty-version}</version>
+		</dependency>
 		<dependency>
 			<groupId>org.eclipse.jetty</groupId>
 			<artifactId>jetty-slf4j-impl</artifactId>
diff --git a/org.restlet.java/org.restlet.ext.velocity/pom.xml b/org.restlet.java/org.restlet.ext.velocity/pom.xml
index a85f0c7965..52a8642151 100644
--- a/org.restlet.java/org.restlet.ext.velocity/pom.xml
+++ b/org.restlet.java/org.restlet.ext.velocity/pom.xml
@@ -19,6 +19,17 @@
 			<groupId>org.apache.velocity</groupId>
 			<artifactId>velocity-engine-core</artifactId>
 			<version>${lib-velocity-version}</version>
+			<exclusions>
+				<exclusion><!-- fix CVEs: CVE-2025-48924-->
+					<groupId>org.apache.commons</groupId>
+					<artifactId>commons-lang3</artifactId>
+				</exclusion>
+			</exclusions>
+		</dependency>
+		<dependency><!-- fix CVEs: CVE-2025-48924-->
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-lang3</artifactId>
+			<version>${lib-cves-commons-lang3-version}</version>
 		</dependency>
 		<dependency>
 			<groupId>org.restlet</groupId>
diff --git a/pom.xml b/pom.xml
index 7c6d581415..494a342501 100644
--- a/pom.xml
+++ b/pom.xml
@@ -53,8 +53,8 @@
         <lib-freemarker-version>2.3.34</lib-freemarker-version>
         <lib-gson-version>2.14.0</lib-gson-version>
         <lib-guice-version>7.0.0</lib-guice-version>
-        <lib-gwt-version>2.13.0</lib-gwt-version>
-        <lib-gwt-server-version>2.13.0</lib-gwt-server-version>
+        <lib-gwt-version>2.13.1</lib-gwt-version>
+        <lib-gwt-server-version>2.13.1</lib-gwt-server-version>
         <lib-istack-version>3.0.12</lib-istack-version>
         <lib-jackson-version>2.19.4</lib-jackson-version>
         <lib-jaxb-ri-version>4.0.9</lib-jaxb-ri-version>
@@ -70,6 +70,9 @@
         <lib-spring-version>6.2.19</lib-spring-version>
         <lib-thymeleaf-version>3.1.5.RELEASE</lib-thymeleaf-version>
         <lib-velocity-version>2.4.1</lib-velocity-version>
+        <!-- fix CVEs -->
+        <lib-cves-guava-version>33.6.0-jre</lib-cves-guava-version>
+        <lib-cves-commons-lang3-version>3.20.0</lib-cves-commons-lang3-version>
         <!-- tests -->
         <lib-junit-version>5.14.4</lib-junit-version>
     </properties>