diff --git a/pass-core-main/pom.xml b/pass-core-main/pom.xml
index 90742f47..0ea56f3c 100644
--- a/pass-core-main/pom.xml
+++ b/pass-core-main/pom.xml
@@ -114,12 +114,6 @@
     <dependency>
       <groupId>org.apache.activemq</groupId>
       <artifactId>artemis-jakarta-server</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>commons-logging</groupId>
-          <artifactId>commons-logging</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
 
     <dependency>
diff --git a/pom.xml b/pom.xml
index 15b37867..862c481c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,6 +119,15 @@
         <scope>import</scope>
       </dependency>
 
+        <!-- Added to fix CVE-2026-22732 -->
+      <dependency>
+        <groupId>org.springframework.security</groupId>
+        <artifactId>spring-security-bom</artifactId>
+        <version>6.5.9</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
@@ -231,6 +240,35 @@
         <version>3.52.0</version>
       </dependency>
       <!-- End of transitive deps with convergence issues. -->
+
+      <!-- The following deps were declared to resolve CVEs from transitive deps. -->
+      <!-- These should all be checked whenever deps are upgraded. Should be removed if possible once parent -->
+      <!-- dep updates with fixed version. -->
+
+      <!-- CVE-2026-27446 -->
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-server</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <dependency>
+          <groupId>org.apache.activemq</groupId>
+          <artifactId>artemis-jakarta-client</artifactId>
+          <version>2.53.0</version>
+          <exclusions>
+              <exclusion>
+                  <groupId>commons-logging</groupId>
+                  <artifactId>commons-logging</artifactId>
+              </exclusion>
+          </exclusions>
+      </dependency>
+      <!-- End of transitive deps with CVE issues. -->
     </dependencies>
   </dependencyManagement>