Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41695Denial of Service in Spring Data Commons Property Path ResolutionMaven · org.springframework.data:spring-data-commons · fixed in 4.0.6, 3.5.12
- CVE-2026-41694SAML Payloads Decrypted Without Valid SignatureMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-41008Spring Security Authorization Server Open Redirect via request_uriMaven · org.springframework.security:spring-security-oauth2-authorization-server · fixed in 7.0.6, 1.5.8
- CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-40993Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database EntryMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6
- CVE-2026-40991XML External Entity (XXE) injection when documenting untrusted XML contentMaven · org.springframework.restdocs:spring-restdocs-restassured, org.springframework.restdocs:spring-restdocs-webtestclient · fixed in 4.0.1, 3.0.6
- CVE-2026-40988Unbounded DEFLATE Inflation in SAML 2.0 Service ProviderMaven · org.springframework.security:spring-security-saml2-service-provider · fixed in 7.0.6, 6.5.11
- CVE-2026-41007Spring HATEOAS heap exhaustion through unbounded internal cachingMaven · org.springframework.hateoas:spring-hateoas · fixed in 3.0.4, 2.5.3
- CVE-2026-41006Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationMaven · org.springframework.hateoas:spring-hateoas · fixed in 3.0.4, 2.5.3
- CVE-2026-41855Spring Framework Unsafe Deserialization via Jackson JMS ConvertersMaven · org.springframework:spring-jms · fixed in 6.2.19, 7.0.8
- CVE-2026-41854Spring Framework Server-Side Request Forgery via UriComponentsBuilderMaven · org.springframework:spring-web · fixed in 7.0.8, 6.2.19
- CVE-2026-41853Spring Framework Multipart Request Smuggling in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41852Spring Framework Arbitrary Method Invocation in SpEL ExpressionsMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19
- CVE-2026-41851Spring Framework Denial of Service via Unbounded Cache in SpELMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19
- CVE-2026-41850Spring Framework Algorithmic Denial of Service via SpEL ExpressionsMaven · org.springframework:spring-expression · fixed in 7.0.8, 6.2.19
- CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsMaven · org.springframework:spring-expression
- CVE-2026-41848Spring Framework Denial of Service via AntPathMatcherMaven · org.springframework:spring-core · fixed in 7.0.8, 6.2.19
- CVE-2026-41847Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLMaven · org.springframework:spring-webflux
- CVE-2026-41846Spring Framework Cross-site Scripting via JSP Form TagsMaven · org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41845Spring Framework Cross-site Scripting via JavaScriptUtilsMaven · org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41844Spring Framework Open Redirect in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41843Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.8, 6.2.19
- CVE-2026-41840Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.Maven · org.springframework:spring-webflux · fixed in 7.0.8, 6.2.19
- CVE-2026-41839Spring Framework Escalation via Session Fixation in WebFluxMaven · org.springframework:spring-webflux · fixed in 7.0.8, 6.2.19
- CVE-2026-41838Spring Framework Predictable Session ID in WebSocket ModuleMaven · org.springframework:spring-websocket · fixed in 7.0.8, 6.2.19
- CVE-2026-41720Authentication Bypass with Empty Password in Spring LDAPMaven · org.springframework.ldap:spring-ldap-core · fixed in 4.0.4, 3.3.8
- CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectMaven · io.projectreactor.netty:reactor-netty · fixed in 1.3.6, 1.2.18
- CVE-2026-41710Cache Exhaustion in Stateful Retries leads to Denial of ServiceMaven · org.springframework.retry:spring-retry · fixed in 2.0.13