Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-100302Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingMaven · org.apache.zookeeper:zookeeper
- CVE-2026-115448Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100300Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply…Maven · org.apache.zookeeper:zookeeper
- CVE-2026-100252Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization IDMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100235Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationMaven · org.apache.zookeeper:zookeeper
- CVE-2026-108946Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connectionMaven · org.apache.activemq:activemq-broker, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12
- CVE-2026-111822Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocationMaven · org.apache.activemq:activemq-runtime-config, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12
- CVE-2026-111821Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journalMaven · org.apache.activemq:activemq-kahadb-store, org.apache.activemq:apache-activemq · fixed in 6.3.3, 5.19.12
- CVE-2026-108949Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOMMaven · org.apache.activemq:activemq-broker · fixed in 6.3.3, 5.19.12
- CVE-2026-46487GeoNetwork: ACL bypass on Elasticsearch search when request body omits query fieldMaven · org.geonetwork-opensource:geonetwork · fixed in 4.2.16, 4.4.11
- CVE-2026-63499zt-zip: ZipUtil.unpack can change file permissions of output directoryMaven · org.zeroturnaround:zt-zip · fixed in 1.18.1
- CVE-2026-63436zt-zip: Path traversal in fluent API unpackMaven · org.zeroturnaround:zt-zip · fixed in 1.18.0
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipMaven · org.apache.oozie:oozie-main
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsingMaven · org.apache.jclouds:jclouds-core
- CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchMaven · org.apache.syncope.core:syncope-core-persistence-jpa
- CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassMaven · org.apache.syncope.core:syncope-core-spring
- CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm updateMaven · org.apache.syncope.core.idrepo:syncope-core-idrepo-logic
- CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service updateMaven · org.apache.syncope.core.am:syncope-core-am-logic
- CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expressionMaven · org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesMaven · org.apache.wicket:wicket-core
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagMaven · org.apache.wicket:wicket-core
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscoreMaven · org.apache.wicket:wicket-core
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderMaven · org.apache.wicket:wicket-core
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceMaven · org.apache.wicket:wicket-core
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesMaven · org.apache.wicket:wicket-core
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalMaven · org.apache.wicket:wicket-core
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataMaven · org.apache.wicket:wicket-extensions
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameMaven · org.apache.wicket:wicket-core