Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-73507Netty: Denial of Service in XmlFrameDecoder via CPU ExhaustionMaven · io.netty:netty-codec-xml · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-48791Sigstore Java has a vulnerability with bundle verification of integratedTimeMaven · dev.sigstore:sigstore-java · fixed in 2.1.0
- CVE-2026-73495blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)Maven · org.http4s:blaze-http_2.12, org.http4s:blaze-http_2.13 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-73493http4s-blaze-server: Unbounded WebSocket message aggregationMaven · org.http4s:http4s-blaze-server_2.12, org.http4s:http4s-blaze-server_2.13 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-73247Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadataMaven · io.kestra:core, io.kestra:kestra-core · fixed in 2.0.0
- CVE-2026-73245Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-authMaven · io.kestra:kestra · fixed in 2.0.0
- CVE-2026-48048XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requestsMaven · org.xwiki.platform:xwiki-platform-livetable-ui · fixed in 16.10.17, 17.4.9, 17.10.3
- CVE-2026-28672Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilderMaven · org.apache.ranger:ranger
- CVE-2026-13505Zeroisation of sensitive key material on garbage collection relies on finalizationMaven · org.bouncycastle:bc-fips · fixed in 1.0.2.7, 2.0.2, 2.1.3
- CVE-2026-8798Native entropy source retries the CPU entropy instructions without limitMaven · org.bouncycastle:bc-fips · fixed in 2.1.3
- CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) adminMaven · org.xwiki.platform:xwiki-platform-webjars-api · fixed in 16.10.17, 17.4.9, 17.10.3
- CVE-2026-56818Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate stateMaven · io.netty:netty-codec-redis · fixed in 4.1.136.Final, 4.2.16.Final
- CVE-2026-71497jsoup: Cleaner may expose markup with custom raw-text elementsMaven · org.jsoup:jsoup · fixed in 1.23.1
- CVE-2026-66274Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowMaven · org.apache.qpid:proton-j · fixed in 0.35.0
- CVE-2026-68494jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)Maven · com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-18401jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceMaven · com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core · fixed in 2.21.1, 2.18.6, 3.1.0
- CVE-2026-10050Digest authentication lossy encodingMaven · org.eclipse.jetty.ee8:jetty-ee8-security, org.eclipse.jetty.ee9:jetty-ee9-security +1 · fixed in 12.0.36, 12.1.10, 9.4.63 and more
- CVE-2026-13506Lazy ASN.1 sequence forcing resets nesting-depth guardMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18 +2 · fixed in 1.0.2.7, 2.0.2, 2.1.3 and more
- CVE-2026-8763Name Constraints bypass via trailing dot in rfc822Name and URIMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk15to18 +2 · fixed in 1.0.2.7, 2.0.2, 2.1.3 and more
- CVE-2026-67340ArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsMaven · com.arcadedb:arcadedb-engine · fixed in 26.7.2
- CVE-2026-67341ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONMaven · com.arcadedb:arcadedb-engine · fixed in 26.7.2
- CVE-2026-67342ArcadeDB before 26.7.2 Authorization Bypass via Database HandlersMaven · com.arcadedb:arcadedb-server · fixed in 26.7.2
- CVE-2026-53573core-geonetwork has an Open Redirect BypassMaven · org.geonetwork-opensource:geonetwork · fixed in 4.2.16, 4.4.11
- CVE-2026-64607Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSMaven · org.apache.httpcomponents.client5:httpclient5 · fixed in 5.6.3
- CVE-2026-59898Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59899Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59900Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassMaven · io.netty:netty-codec-http2 · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59901Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread HangMaven · io.netty:netty-codec, io.netty:netty-codec-compression · fixed in 4.1.136.Final, 4.2.16.Final
- CVE-2026-59919Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressMaven · io.netty:netty-codec-haproxy · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59920Netty: STOMP CONNECT Frame Header InjectionMaven · io.netty:netty-codec-stomp · fixed in 4.2.16.Final, 4.1.136.Final