Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-50645Apache CXF: No restriction on attachment headers per messageMaven · org.apache.cxf:cxf-core · fixed in 4.2.2, 4.1.7, 3.6.12
- CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entryMaven · org.apache.cxf:cxf-rt-rs-security-jose-jaxrs · fixed in 4.2.2, 4.1.7
- CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImplMaven · org.apache.cxf:cxf-integration-jca · fixed in 4.2.2, 4.1.7
- CVE-2026-50632Apache CXF: JNDI Injection Vulnerability in JMSConfigFactoryMaven · org.apache.cxf:cxf-rt-transports-jms · fixed in 4.2.2, 4.1.7, 3.6.12
- CVE-2026-50631Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token ProcessingMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50630Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm InjectionMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50629Apache CXF: OAuth2: Log Injection via Unsanitized Client IdentifierMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security ControlMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token ValidatorMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsMaven · org.apache.cxf:cxf-core · fixed in 4.2.2, 4.1.7, 3.6.12
- CVE-2026-50623Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionServiceMaven · org.apache.cxf:cxf-rt-rs-security-oauth2 · fixed in 4.2.2, 4.1.7
- CVE-2026-44892Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header SizeMaven · io.netty:netty-codec-http3 · fixed in 4.2.15.Final
- CVE-2026-44890Netty has Unbounded Direct Memory Consumption in its RedisDecoderMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-44250Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysMaven · io.netty:netty-codec-redis · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-44249Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingMaven · io.netty:netty-handler · fixed in 4.2.15.Final, 4.1.135.Final
- CVE-2026-11986Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloakMaven · org.keycloak:keycloak-rest-admin-ui-ext · fixed in 26.7.0
- CVE-2026-41856Spring GraphQL Annotation Detection VulnerabilityMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQLMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41699Unsafe Deserialization in Spring GraphQLMaven · org.springframework.graphql:spring-graphql · fixed in 2.0.4, 1.4.6
- CVE-2026-41001Predictable Temp Directory in Artemis Auto-configurationMaven · org.springframework.boot:spring-boot-autoconfigure · fixed in 4.0.7, 3.5.15
- CVE-2026-41000WSS4J validation does not use configured replay cacheMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinationsMaven · org.springframework.ws:spring-ws-core · fixed in 5.0.2, 4.1.4
- CVE-2026-40998Jaxp13 XPath XXE via StreamSource and SAXSourceMaven · org.springframework.ws:spring-xml · fixed in 5.0.2, 4.1.4
- CVE-2026-40997SOAP security faults leak Spring Security account stateMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40996Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40995X.509 authentication bypasses Spring Security account checksMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40994Wss4jSecurityInterceptor disables WS-I BSP validation by defaultMaven · org.springframework.ws:spring-ws-security · fixed in 5.0.2, 4.1.4
- CVE-2026-40992Mail Auto-Configuration Does Not Enable SSL Hostname VerificationMaven · org.springframework.boot:spring-boot-starter-mail · fixed in 4.0.7, 3.5.15
- CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationMaven · org.springframework.integration:spring-integration-file · fixed in 7.0.5, 6.5.9
- CVE-2026-40986Spring Web Flow JS RemotingHandler renders non-HTML Response as HTMLMaven · org.springframework.webflow:spring-webflow · fixed in 4.0.1, 3.0.2