Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40047Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerMaven · org.apache.camel:camel-docling · fixed in 4.18.3
- CVE-2026-54712OpenTelemetry Javaagent RMI context propagation allows resource exhaustionMaven · io.opentelemetry.javaagent:opentelemetry-javaagent · fixed in 2.27.0
- CVE-2026-54704OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text PasswordsMaven · io.opentelemetry.javaagent:opentelemetry-javaagent · fixed in 2.28.0-alpha
- CVE-2026-55153mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"Maven · com.mchange:mchange-commons-java · fixed in 0.6.0
- CVE-2026-55688AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreMaven · org.asynchttpclient:async-http-client · fixed in 3.0.11, 2.16.0
- CVE-2026-54428Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKMaven · org.apache.httpcomponents.core5:httpcore5-h2 · fixed in 5.4.3, 5.5-beta2
- CVE-2026-54399Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default ConfigurationMaven · org.apache.httpcomponents.core5:httpcore5 · fixed in 5.4.3, 5.5-beta2
- CVE-2026-55223c3p0 exposes a deserialization "sink" via JDBC DataSource bean propertiesMaven · com.mchange:c3p0 · fixed in 0.14.0
- CVE-2025-53648Apache Gravitino: SQL misconfiguration can access or truncate filesMaven · org.apache.gravitino:catalog-jdbc-common · fixed in 1.0.0
- CVE-2026-49434Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties…Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-49432Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of serviceMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-stomp +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-49877Apache ActiveMQ: Authenticated web users retain admin access by default in the Web ConsoleMaven · org.apache.activemq:apache-activemq · fixed in 5.19.8, 6.2.7
- CVE-2026-50734Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-client +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-50750Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-52760Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web ConsoleMaven · org.apache.activemq:activemq-web-console, org.apache.activemq:apache-activemq +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-53917Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +2 · fixed in 5.19.8, 6.2.7
- CVE-2026-54475Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.8, 6.2.7
- CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.5, 10.1.37, 9.0.101
- CVE-2026-55956Apache Tomcat: Security constraints for default servlet ignored methodMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-55955Apache Tomcat: EncryptInterceptor not protected against replay attacksMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-tribes · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-55276Apache Tomcat: Logged effective web.xml is incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorMaven · org.apache.tomcat:tomcat-util · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-53404Apache Tomcat: Bad ornext processing in RewriteValveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-50229Apache Tomcat: XSS in number guess exampleMaven · org.apache.tomcat:tomcat · fixed in 11.0.23, 10.1.56, 9.0.119
- CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadataMaven · org.jetbrains.kotlin:kotlin-gradle-plugin · fixed in 2.4.20-Beta1
- CVE-2025-64152Apache IoTDB: Path Traversal VulnerabilityMaven · org.apache.iotdb:iotdb-server · fixed in 1.3.6, 2.0.7
- CVE-2025-55017Apache IoTDB: Path Traversal VulnerabilityMaven · org.apache.iotdb:iotdb-server · fixed in 2.0.6, 1.3.6
- CVE-2026-57914Apache Kerby: StackOverflow on parsing deeply nested ASN1 structuresMaven · org.apache.kerby:kerby-asn1 · fixed in 2.1.2
- CVE-2026-12993Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetMaven · io.apicurio:apicurio-registry-schema-util-xml · fixed in 3.3.1, 3.2.6
- CVE-2026-12992Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validationMaven · io.apicurio:apicurio-registry-schema-util-wsdl · fixed in 3.3.1, 3.2.6