Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45367HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointMaven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may +6 · fixed in 6.9.7
- CVE-2026-55548Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsMaven · org.yamcs:yamcs-core · fixed in 5.13.2, 5.12.8
- CVE-2026-46621Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code InjectionMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-46562Yamcs: Remote Code Execution via Mission Database algorithm overrideMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44632Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`Maven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44596Yamcs: No Rate Limiting on Authentication EndpointMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-44595Yamcs: Unauthorized user enumeration via IAM API endpointsMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2025-32781Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59954Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59955Apollo ConfigService access key authentication bypass via raw config file appId parsingMaven · com.ctrip.framework.apollo:apollo
- CVE-2026-59889jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserializationMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.5, 2.18.9, 2.22.1 and more
- CVE-2026-59888jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2024-7708For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.Maven · org.eclipse.jetty:jetty-server · fixed in 10.0.23, 11.0.23
- CVE-2026-8384In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admiMaven · org.eclipse.jetty:jetty-util · fixed in 12.0.35, 12.1.9
- CVE-2026-6790In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what pMaven · org.eclipse.jetty:jetty-server · fixed in 12.0.35, 12.1.9
- CVE-2026-10051In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the Maven · org.eclipse.jetty:jetty-server · fixed in 12.0.36, 12.1.10
- CVE-2026-55771CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiesMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- CVE-2026-55773CedarJava has a policy injection vulnerabilityMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- CVE-2026-55772CedarJava has a type confusion vulnerabilityMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- CVE-2026-55175Spinnaker: Improper yaml processing on kustomize bake operationsMaven · io.spinnaker.rosco:rosco-manifests · fixed in 2025.3.4, 2025.4.4, 2026.0.3 and more
- CVE-2026-44795Spinnaker: Non-safe yaml deserialization allowing RCE when using specific typesMaven · io.spinnaker.orca:orca-core, io.spinnaker.rosco:rosco-core · fixed in 2025.3.3, 2025.4.4, 2026.0.3
- CVE-2026-49844Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()Maven · org.apache.logging.log4j:log4j-api · fixed in 2.25.5, 2.26.1
- CVE-2026-55405LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvectorMaven · dev.langchain4j:langchain4j-mariadb, dev.langchain4j:langchain4j-pgvector · fixed in 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19 and more
- CVE-2026-55471HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryMaven · ca.uhn.hapi.fhir:org.hl7.fhir.utilities · fixed in 6.9.10
- CVE-2026-55470HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSMaven · ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 +2 · fixed in 6.9.10
- CVE-2026-55760handlebars.java FileTemplateLoader Path TraversalMaven · com.github.jknack:handlebars · fixed in 4.5.2
- CVE-2026-54291Silent channel-binding authentication downgrade via unsupported certificate algorithmsMaven · org.postgresql:postgresql · fixed in 42.7.12
- CVE-2026-46588Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputMaven · org.apache.camel:camel-couchdb · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-46587Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted inputMaven · org.apache.camel:camel-couchbase · fixed in 4.14.8, 4.18.3, 4.21.0
- CVE-2026-49042Apache Camel: langchain4j-tools: filter tool argument headers against declared parametersMaven · org.apache.camel:camel-langchain4j-agent, org.apache.camel:camel-langchain4j-tools +1 · fixed in 4.18.3, 4.21.0