diff --git a/obp-api/pom.xml b/obp-api/pom.xml
index e388029711..c5ef98268a 100644
--- a/obp-api/pom.xml
+++ b/obp-api/pom.xml
@@ -82,7 +82,7 @@
     <dependency>
       <groupId>org.postgresql</groupId>
       <artifactId>postgresql</artifactId>
-      <version>42.7.3</version>
+      <version>42.7.7</version>
     </dependency>
     <!-- https://mvnrepository.com/artifact/com.oracle.database.jdbc/ojdbc8-production -->
     <dependency>
@@ -105,6 +105,27 @@
       <artifactId>mysql-connector-j</artifactId>
       <version>8.0.33</version>
     </dependency>
+    <!-- Pin protobuf-java to override the 3.21.9 pulled in transitively by mysql-connector-j.
+         Fixes CVE-2024-7254 and CVE-2026-0994. -->
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+      <version>3.25.5</version>
+    </dependency>
+    <!-- Pin snappy-java to override the 1.1.1.3 pulled in transitively by avro 1.8.2.
+         Fixes CVE-2023-34453, CVE-2023-34454, CVE-2023-34455, CVE-2023-43642. -->
+    <dependency>
+      <groupId>org.xerial.snappy</groupId>
+      <artifactId>snappy-java</artifactId>
+      <version>1.1.10.4</version>
+    </dependency>
+    <!-- Pin commons-beanutils to override the 1.9.2 pulled in transitively via
+         everit json-schema → commons-validator. Fixes CVE-2025-48734, CVE-2019-10086. -->
+    <dependency>
+      <groupId>commons-beanutils</groupId>
+      <artifactId>commons-beanutils</artifactId>
+      <version>1.10.1</version>
+    </dependency>
 
     <dependency>
       <groupId>junit</groupId>
diff --git a/obp-commons/pom.xml b/obp-commons/pom.xml
index bd0b365cb1..d69346a214 100644
--- a/obp-commons/pom.xml
+++ b/obp-commons/pom.xml
@@ -204,7 +204,7 @@
                     <plugin>
                         <groupId>org.owasp</groupId>
                         <artifactId>dependency-check-maven</artifactId>
-                        <version>8.4.3</version>
+                        <version>12.1.0</version>
                         <configuration>
                             <!-- Use NVD API 2.0 key from environment -->
                             <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
diff --git a/pom.xml b/pom.xml
index 48f71c4989..5ac5a44dad 100644
--- a/pom.xml
+++ b/pom.xml
@@ -87,7 +87,7 @@
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-lang3</artifactId>
-        <version>3.14.0</version>
+        <version>3.18.0</version>
       </dependency>
       <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-text -->
       <dependency>