Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54081veraPDF Parser DoS via PostScript Type 1 Font ProgramsMaven · org.verapdf:parser · fixed in 1.30.2, 1.31.23
- CVE-2026-54080veraPDF Parser DoS via PostScript CMap StreamsMaven · org.verapdf:parser · fixed in 1.30.2, 1.31.23
- CVE-2026-54082veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-54078veraPDF Validation XXE via Rich TextMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-54079veraPDF Validation XXE via XFAMaven · org.verapdf:validation-model, org.verapdf:validation-model-jakarta · fixed in 1.30.2, 1.31.71
- CVE-2026-56822Netty: TOCTOU in OcspServerCertificateValidatorMaven · io.netty:netty-handler-ssl-ocsp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56821Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatorMaven · io.netty:netty-handler-ssl-ocsp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-59921Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-54609QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingMaven · com.quietterminal:qti-neon
- CVE-2026-43910Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutorMaven · io.appium:java-client · fixed in 10.1.1
- CVE-2026-43871Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitMaven · org.apache.thrift:libthrift · fixed in 0.24.0
- CVE-2026-16723Remote Code Execution in fastjson 1.2.68–1.2.83Maven · com.alibaba:fastjson
- CVE-2026-56820Netty: Missing CertificateID Validation in OCSP Response Allows Replay AttacksMaven · io.netty:netty-handler-ssl-ocsp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56819Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)Maven · io.netty:netty-codec-http2 · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56817Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabledMaven · io.netty:netty-codec-xml · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56816Netty: Memory Exhaustion via HTTP/3 Reserved Frame TypesMaven · io.netty:netty-codec-http3 · fixed in 4.2.16.Final
- CVE-2026-56746Netty has a Security Control Bypass via CORS Short-Circuit FailureMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56745Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory ExhaustionMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-55851Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionMaven · io.netty:netty-codec-haproxy · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-47695CC-Tweaked has an SSRF Protection Bypass with NAT64Maven · cc.tweaked:cc-tweaked-1.19.3-core, cc.tweaked:cc-tweaked-1.19.4-core +6 · fixed in 1.119.0
- CVE-2026-16454Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware ExfiltrationMaven · org.eclipse.hawkbit:hawkbit-ddi-resource · fixed in 1.0.4
- CVE-2026-55833Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-55831Netty SPDY SETTINGS frame count materializes unbounded settings mapMaven · io.netty:netty-codec-http · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-56740JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON VariablesMaven · org.jline:jline-remote-telnet · fixed in 4.2.1, 4.0.16, 3.30.14
- CVE-2026-56741JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal GeometryMaven · org.jline:jline-remote-telnet · fixed in 4.2.1, 4.0.16, 3.30.14
- CVE-2026-49485HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointMaven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may +6 · fixed in 6.9.9, 6.9.4.2
- CVE-2026-44891Netty: Denial of Service via Unbounded Headers in StompSubframeDecoderMaven · io.netty:netty-codec-stomp · fixed in 4.2.16.Final, 4.1.136.Final
- CVE-2026-45799Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding serviceMaven · com.squareup.wire:wire-runtime, com.squareup.wire:wire-runtime-jvm · fixed in 6.3.0, 7.0.0-alpha03
- CVE-2026-53712SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithmsMaven · com.ongres.scram:scram-client, com.ongres.scram:scram-common · fixed in 3.3
- CVE-2026-62238OpenRemote < 1.26.0 SQL Injection via Crosstab ExportMaven · io.openremote:openremote-manager · fixed in 1.26.0