Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-57287Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying hiMaven · org.jenkins-ci.plugins:jobconfighistory · fixed in 1367
- CVE-2026-57286A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtaMaven · org.jenkins-ci.tools:git-parameter · fixed in 462.463
- CVE-2026-57285A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read perMaven · org.jenkins-ci.plugins:github-branch-source · fixed in 1967.1970
- CVE-2026-57284Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniMaven · io.jenkins.plugins:pipeline-groovy-lib · fixed in 4331.4333
- CVE-2026-57283A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instMaven · io.jenkins.plugins:pipeline-groovy-lib · fixed in 4331.4333
- CVE-2026-57282Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH Maven · org.jenkins-ci.plugins:git-client · fixed in 6.6.1
- CVE-2026-57281Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mMaven · org.jenkins-ci.plugins:script-security · fixed in 1402.1405.vc96e74964250
- CVE-2026-57280Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed foMaven · org.jenkins-ci.plugins:script-security · fixed in 1402.1405.vc96e74964250
- CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databindMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-50193jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()Maven · com.fasterxml.jackson.core:jackson-databind · fixed in 2.14.0
- CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts withoMaven · org.springframework.statemachine:spring-statemachine-kryo · fixed in 4.0.2
- CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 3.1.4, 2.18.9, 2.21.5 and more
- CVE-2026-54516jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-54517jackson-databind: @JsonView bypass for setterless creator propertiesMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.4, 3.1.4
- CVE-2026-56784OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion EndpointMaven · io.openremote:openremote-manager · fixed in 1.25.0
- CVE-2026-12866All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API.Maven · org.webjars.npm:expr-eval
- CVE-2025-62198Apache Atlas: Stored XSS in Create Entity pageMaven · org.apache.atlas:atlas-dashboardv2 · fixed in 2.5.0
- CVE-2026-44914Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow ContentsMaven · org.apache.nifi:nifi-web-api · fixed in 2.9.0
- CVE-2026-44911Apache NiFi: Incorrect Authorization for Configuration Verification RequestsMaven · org.apache.nifi:nifi-web-api · fixed in 2.10.0
- CVE-2026-44913Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQLMaven · org.apache.nifi:nifi-cdc-mysql-processors · fixed in 2.10.0
- CVE-2026-54665Apache NiFi: Missing Validation for Proxy Host HeadersMaven · org.apache.nifi:nifi-jetty · fixed in 2.10.0
- CVE-2026-11748A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm suMaven · com.linecorp.centraldogma:centraldogma-server-auth-shiro · fixed in 0.84.0
- CVE-2026-11746A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting reMaven · com.linecorp.centraldogma:centraldogma-server · fixed in 0.84.0
- CVE-2026-11745A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verMaven · com.linecorp.centraldogma:centraldogma-server-mirror-git · fixed in 0.84.0
- CVE-2026-50559Authentication/Authorization Bypass via Advanced Path Normalization VulnerabilitiesMaven · io.quarkus:quarkus-vertx-http · fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1 and more
- CVE-2026-11752A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve contMaven · com.linecorp.armeria:armeria-xds · fixed in 1.40.0
- CVE-2025-53114CometD has acknowledgement extension out of memoryMaven · org.cometd.java:cometd-java-server-common · fixed in 5.0.23, 6.0.19, 7.0.19 and more