Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-58175GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-main · fixed in 2.26.4, 2.27.3
- CVE-2025-52465GeoServer has an arbitrary file write vulnerability in its Master Password Dump PageMaven · org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core · fixed in 2.27.3, 2.26.4
- CVE-2025-27511GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store ConnectionMaven · org.geoserver.extension:gs-db2 · fixed in 2.27.0
- CVE-2026-49268Apache Shiro: LDAP DN Injection in DefaultLdapRealmMaven · org.apache.shiro:shiro-core · fixed in 2.2.1, 3.0.0-alpha-2
- CVE-2026-47340Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.Maven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.4.2
- CVE-2026-32967Apache DolphinScheduler: The `/v2` experimental interface lacks permission checksMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.4.2
- CVE-2026-42357Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.Maven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.4.2
- CVE-2026-41280Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projectsMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.4.2
- CVE-2026-32966Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata DisclosureMaven · org.apache.dolphinscheduler:dolphinscheduler-api · fixed in 3.4.2
- CVE-2026-41708Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilityMaven · org.springframework.cloud:spring-cloud-sleuth-instrumentation
- CVE-2026-47835Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector StoresMaven · org.springframework.ai:spring-ai-elasticsearch-store, org.springframework.ai:spring-ai-gemfire-store +1 · fixed in 1.0.9, 1.1.8
- CVE-2026-39006An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.Maven · org.snmp4j:snmp4j-agent
- CVE-2026-50560Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureMaven · io.netty:netty-codec-http2 · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50020Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedMaven · io.netty:netty-codec-http · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verificationMaven · io.netty:netty-handler · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-50009Netty QUIC stateless reset token material exposed through header-visible connection IDsMaven · io.netty:netty-codec-classes-quic · fixed in 4.2.15.Final
- CVE-2026-48748Netty HTTP/3 QPACK Blocked Streams Memory ExhaustionMaven · io.netty:netty-codec-http3 · fixed in 4.2.15.Final
- CVE-2026-48059Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionMaven · io.netty:netty-codec-haproxy · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-48043netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionMaven · io.netty:netty-codec-http2 · fixed in 4.1.135.Final, 4.2.15.Final
- CVE-2026-48006Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47691Netty has Insufficient Bailiwick Validation for NS RecordsMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-47244Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedMaven · io.netty:netty-codec-http2 · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-46340Netty: SCTP reassembly nests buffers without boundMaven · io.netty:netty-transport-sctp · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-45674Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-45673Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortMaven · io.netty:netty-resolver-dns · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-45536Netty: Unix-socket fd receive leaks descriptors when peer sends two at onceMaven · io.netty:netty-transport-native-epoll, io.netty:netty-transport-native-kqueue · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesMaven · io.netty:netty-handler · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-44894Netty's Default QUIC token handler accepts any client-supplied tokenMaven · io.netty:netty-codec-classes-quic · fixed in 4.2.15.Final
- CVE-2026-44893Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthMaven · io.netty:netty-codec-haproxy · fixed in 4.2.15.Final, 4.1.135.Final