Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-12975Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dosMaven · io.apicurio:apicurio-registry-schema-util-common · fixed in 3.3.1, 3.2.6
- CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probingMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonMaven · org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services · fixed in 26.0.10, 26.6.4
- CVE-2026-56091Apache Shiro: Authentication bypass in Guice-Web integrationMaven · org.apache.shiro:shiro-guice · fixed in 3.0.0
- CVE-2026-56130Apache Shiro: Remember-me cookie isn't checked for expiry on the serverMaven · org.apache.shiro:shiro-core, org.apache.shiro:shiro-web · fixed in 3.0.0
- CVE-2026-12986A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows thMaven · fish.payara.distributions:payara · fixed in 7.2026.6
- CVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permissionMaven · io.jenkins.plugins:zdevops
- CVE-2026-57306A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to coMaven · io.jenkins.plugins:zdevops
- CVE-2026-57305A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57304A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57303Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers aMaven · org.jenkins-ci.plugins:assembla
- CVE-2026-57302Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be vMaven · org.jenkins-ci.plugins:fitnesse
- CVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attaMaven · org.jenkins-ci.plugins:zapper
- CVE-2026-57300A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read Maven · io.jenkins.plugins:mcp-server · fixed in 0.178.vffe5a
- CVE-2026-57299Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permMaven · org.jenkins-ci.plugins:contrast-continuous-application-security · fixed in 3.12
- CVE-2026-57298A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackeMaven · org.jenkins-ci.plugins:contrast-continuous-application-security · fixed in 3.12
- CVE-2026-57297A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read peMaven · org.jenkins-ci.plugins:contrast-continuous-application-security · fixed in 3.12
- CVE-2026-57296Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided tMaven · org.jenkins-ci.plugins:external-workspace-manager · fixed in 1.4.0
- CVE-2026-57295A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to conneMaven · com.amazon.jenkins.fleet:ec2-fleet · fixed in 4.2.3.540.va
- CVE-2026-57294A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission toMaven · com.amazon.jenkins.fleet:ec2-fleet · fixed in 4.2.3.540.va
- CVE-2026-57293An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permissiMaven · org.jenkins-ci.plugins:gitee · fixed in 1292.v2559f2f3f2c0
- CVE-2026-57292A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to aMaven · org.jenkins-ci.plugins:gitee · fixed in 1292.v2559f2f3f2c0
- CVE-2026-57291Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect Maven · org.jenkins-ci.plugins:gitee · fixed in 1292.v2559f2f3f2c0
- CVE-2026-57290A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwMaven · org.jenkins-ci.plugins:prioritysorter · fixed in 936.937.v5581d0b
- CVE-2026-57289Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for coMaven · io.jenkins.plugins:bitbucket-push-and-pull-request · fixed in 3.3.9
- CVE-2026-57288Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativMaven · org.jenkins-ci.plugins:active-directory · fixed in 2.41.2