Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL ParserMaven · org.springframework.webflow:spring-webflow · fixed in 4.0.1, 3.0.2
- CVE-2026-42568Yamcs Vulnerable to LDAP Injection in LdapAuthModuleMaven · org.yamcs:yamcs-core · fixed in 5.12.7
- CVE-2026-53442Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job confMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53441Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.568
- CVE-2026-53440Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" securityMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53439Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine otMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53438A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking IMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53437Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53436Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.568, 2.555.3
- CVE-2026-53435In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in JMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555.3, 2.568
- CVE-2026-53698Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.Maven · org.silverpeas.core:silverpeas-core, org.silverpeas.core:silverpeas-core-war
- CVE-2026-47838Unauthorized User Impersonation when Using X.509 Client CertificatesMaven · org.springframework.security:spring-security-web · fixed in 6.5.11
- CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keysMaven · org.springframework.data:spring-data-rest-core · fixed in 5.0.6, 4.5.12
- CVE-2026-41732In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserializationMaven · org.springframework.pulsar:spring-pulsar · fixed in 2.0.6, 1.2.18
- CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationMaven · org.springframework.kafka:spring-kafka · fixed in 4.0.6, 3.3.16
- CVE-2026-41730Spring Data REST exposes persistence-layer internals in error responsesMaven · org.springframework.data:spring-data-rest-core · fixed in 5.0.6, 4.5.12
- CVE-2026-41729Spring Data REST SpEL Injection via Map Key in JSON PatchMaven · org.springframework.data:spring-data-rest-core · fixed in 5.0.6, 4.5.12
- CVE-2026-41728Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsMaven · org.springframework.data:spring-data-rest-core · fixed in 5.0.6, 4.5.12
- CVE-2026-41727In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorMaven · org.springframework.kafka:spring-kafka · fixed in 4.0.6, 3.3.16
- CVE-2026-41726In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerMaven · org.springframework.kafka:spring-kafka · fixed in 4.0.6, 3.3.16
- CVE-2026-41721Spring Data Commons Denial of Service via Data BindingMaven · org.springframework.data:spring-data-commons · fixed in 4.0.6, 3.5.12
- CVE-2026-41719Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparatorMaven · org.springframework.data:spring-data-keyvalue · fixed in 4.0.6, 3.5.12
- CVE-2026-41717Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingMaven · org.springframework.data:spring-data-mongodb · fixed in 5.0.6, 4.5.12
- CVE-2026-41716Spring Data web support unbounded negative-result cache keyed on attacker-supplied property namesMaven · org.springframework.data:spring-data-commons · fixed in 4.0.6, 3.5.12
- CVE-2026-41714In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManagerMaven · org.springframework.amqp:spring-amqp · fixed in 4.0.4, 3.2.11
- CVE-2026-41711Potential Denial of Service through crafted Sort ParametersMaven · org.springframework.data:spring-data-commons · fixed in 4.0.6, 3.5.12
- CVE-2026-41706Open Redirect When Using CookieRequestCacheMaven · org.springframework.security:spring-security-web · fixed in 7.0.6, 6.5.11
- CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesMaven · org.springframework.amqp:spring-amqp · fixed in 4.0.4, 3.2.11
- CVE-2026-41697Spring Data Relational Parameter not Escaped for Query By Example LIKE PatternMaven · org.springframework.data:spring-data-relational · fixed in 4.0.6, 3.5.12
- CVE-2026-41696Spring Data MongoDB Bind Parameter Literal Quoting BreakoutMaven · org.springframework.data:spring-data-mongodb · fixed in 5.0.6, 4.5.12