Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.25, 10.1.58, 9.0.121
- CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsMaven · org.apache.hive:hive-standalone-metastore
- CVE-2026-77310jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.9, 2.21.5, 2.22.1 and more
- CVE-2026-78329Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routesMaven · org.apache.camel:camel-undertow · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-71300Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injectionMaven · org.apache.camel:camel-atmosphere-websocket · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-63621Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategyMaven · org.apache.camel:camel-knative · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-66908Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was acceptedMaven · org.apache.camel:camel-platform-http-main · fixed in 4.22.0
- CVE-2026-66907Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultMaven · org.apache.camel:camel-google-storage · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-66906Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirMaven · org.apache.camel:camel-azure-storage-blob · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-60093Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDirMaven · org.apache.camel:camel-azure-storage-datalake · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-59230Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabledMaven · org.apache.camel:camel-mail · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-76904GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layersMaven · org.geotools.jdbc:gt-jdbc-postgis · fixed in 35.1, 34.5, 33.6
- CVE-2026-75140jsoup Uncontrolled Resource Consumption in XmlTreeBuilderMaven · org.jsoup:jsoup · fixed in 1.23.2
- CVE-2026-63490Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassMaven · com.github.jknack:handlebars-springmvc · fixed in 4.5.3
- CVE-2026-75595Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextMaven · io.netty:netty-handler · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-75596Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingMaven · io.netty:netty-handler · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-18963Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassMaven · org.keycloak:keycloak-services · fixed in 26.4.15, 26.6.6, 26.7.2
- CVE-2026-61634RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_maxMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-63336RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITMMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-63337RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingMaven · com.rabbitmq:amqp-client · fixed in 5.33.0
- CVE-2026-69220RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSMaven · com.rabbitmq:amqp-client · fixed in 5.33.1
- CVE-2026-69219RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationMaven · com.rabbitmq:amqp-client · fixed in 5.33.1
- CVE-2026-63335RabbitMQ Java client malformed body frame triggers raw command assembler exceptionMaven · com.rabbitmq:amqp-client · fixed in 5.31.0
- CVE-2026-55839Kestra: Stored XSS via custom Markdown [[link]] attribute injectionMaven · io.kestra:kestra · fixed in 1.3.24
- CVE-2026-59949yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)Maven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.1
- CVE-2026-59903Netty: Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteMaven · io.netty:netty-codec-http · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandlerMaven · io.netty:netty-transport-sctp · fixed in 4.2.17.Final, 4.1.137.Final
- CVE-2026-49989CrateDB's Blob HTTP handler bypasses authorizationMaven · io.crate:crate · fixed in 6.2.8, 6.3.2
- CVE-2026-73644OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grantMaven · org.openidentityplatform.opendj:opendj-server-legacy · fixed in 5.1.2
- CVE-2026-73508Netty: Memory Leak in DNS Record Decoder via Malformed Domain NamesMaven · io.netty:netty-codec-dns · fixed in 4.2.16.Final, 4.1.136.Final