Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-119078Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keysMaven · commons-codec:commons-codec · fixed in 1.23.0
- CVE-2026-124077Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)Maven · commons-codec:commons-codec · fixed in 1.23.0
- CVE-2026-120367Apache Axis2/Java: unbounded JSON request body bufferingMaven · org.apache.axis2:axis2-json · fixed in 2.0.2
- CVE-2026-123779Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routesMaven · org.apache.axis2:axis2-openapi, org.apache.axis2:axis2-transport-http · fixed in 2.0.2
- CVE-2026-123753Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpointsMaven · org.apache.axis2:axis2-kernel · fixed in 2.0.2
- CVE-2026-123766Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI pageMaven · org.apache.axis2:axis2-openapi · fixed in 2.0.2
- CVE-2026-123770Apache Axis2/Java: Unbounded multipart and form-encoded request bodiesMaven · org.apache.axis2:axis2-kernel · fixed in 2.0.2
- CVE-2026-120761Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documentsMaven · org.apache.axis2:axis2-kernel · fixed in 2.0.2
- CVE-2026-120832Apache Axis2/Java: SSRF via WSDL/XSD schema import resolutionMaven · org.apache.axis2:axis2-kernel · fixed in 2.0.2
- CVE-2026-82436Apache Storm Client: Deserialization of Untrusted Data from the State StoreMaven · org.apache.storm:storm-client · fixed in 3.1.0
- CVE-2026-82440Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy AllowlistMaven · org.apache.storm:storm-client · fixed in 3.1.0
- CVE-2026-59171JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoSMaven · org.json:json · fixed in 20260719
- CVE-2026-75598Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitizationMaven · com.gradleup.shadow:com.gradleup.shadow.gradle.plugin · fixed in 9.6.0
- CVE-2026-90436Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionNameMaven · axis:axis, org.apache.axis:axis
- CVE-2026-85111Apache James: Denial of service upon MIME parsingMaven · org.apache.james:james-server · fixed in 3.9.1
- CVE-2026-85108Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or ThrottlingMaven · org.apache.james:apache-mime4j-core, org.apache.james:apache-mime4j-dom · fixed in 0.8.15
- CVE-2026-54442NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRFMaven · gov.nsa.emissary:emissary · fixed in 8.51.0
- CVE-2026-121489Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryMaven · org.apache.juneau:juneau-commons, org.apache.juneau:juneau-microservice-core · fixed in 9.2.1
- CVE-2026-96677Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeMaven · org.apache.juneau:juneau-marshall · fixed in 9.2.1
- CVE-2026-73117Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataMaven · org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-73116Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsMaven · org.apache.juneau:juneau-rest-client, org.apache.juneau:juneau-rest-common · fixed in 9.2.1
- CVE-2026-73101Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsMaven · org.apache.juneau:juneau-rest-server. · fixed in 9.2.1
- CVE-2026-73100Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsMaven · org.apache.juneau:juneau-rest-common, org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideMaven · org.apache.juneau:juneau-rest-server. · fixed in 9.2.1
- CVE-2026-73098Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingMaven · org.apache.juneau:juneau-marshall · fixed in 9.2.1
- CVE-2026-73095Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingMaven · org.apache.juneau:juneau-marshall, org.apache.juneau:juneau-rest-server · fixed in 9.2.1
- CVE-2026-112072vault-java-driver: stored deeply nested JSON kills every thread that reads itMaven · io.github.jopenlibs:vault-java-driver · fixed in 7.0.0
- CVE-2026-109408vault-java-driver: SslConfig silently disables requested TLS verificationMaven · io.github.jopenlibs:vault-java-driver · fixed in 7.0.0
- CVE-2026-106554jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)Maven · com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversMaven · net.snowflake:snowflake-jdbc, net.snowflake:snowflake-jdbc-fips +1 · fixed in 4.4.0