Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-83557jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more
- CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)Maven · org.jolokia:jolokia-service-jsr160 · fixed in 2.6.2
- CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more
- CVE-2026-55860MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)Maven · org.mariadb:r2dbc-mariadb · fixed in 1.4.1
- CVE-2026-55859MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbMaven · org.mariadb:r2dbc-mariadb · fixed in 1.4.1
- CVE-2026-55858MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55857MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55856MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakeMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-55848mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain typesMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet +1 · fixed in 3.28.30, 3.30.32, 3.33.16 and more
- CVE-2026-55867Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensMaven · org.graylog2:graylog2-server · fixed in 6.3.12, 7.0.7, 7.1.2
- CVE-2026-55841Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageMaven · org.graylog2:graylog2-server · fixed in 6.3.12, 7.0.7, 7.1.2
- CVE-2026-55673PowSyBl: Command Injection in LocalCommandExecutor-sMaven · com.powsybl:powsybl-computation-local · fixed in 7.2.2
- CVE-2026-55425Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fieldsMaven · org.graylog2:graylog2-server · fixed in 7.1.4
- CVE-2026-55566Yamcs: DOM XSS in Extension RoutingMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55565Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55552Yamcs: Unauthenticated Directory TraversalMaven · org.yamcs:yamcs-core · fixed in 5.12.0
- CVE-2026-55549Yamcs: Reflected XSS in the URL of the Authorize EndpointMaven · org.yamcs:yamcs-core · fixed in 5.9.4
- CVE-2026-55547Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security ConfigurationMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55545Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforceMaven · org.yamcs:yamcs-core · fixed in 5.12.8, 5.13.2
- CVE-2026-55521Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core APIMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-55511Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`Maven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-47892Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsMaven · org.springframework:spring-webflux · fixed in 7.0.9
- CVE-2026-47890Spring Framework Server Sent Event stream corruption while rendering fragmentsMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.9
- CVE-2026-47884Spring Framework Improper Path Limitation in XsltViewMaven · org.springframework:spring-webmvc · fixed in 7.0.9
- CVE-2026-54550IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entriesMaven · org.codehaus.izpack:izpack-installer · fixed in 5.2.7
- CVE-2026-54556Http4s: HTTP/2 Denial of Service with Ember BackendMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authenticationMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.25, 10.1.59, 9.0.121