Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerabilityMaven · io.micrometer:micrometer-core, io.micrometer:micrometer-jetty11 +1 · fixed in 1.16.6, 1.15.12
- CVE-2026-40983Micrometer gRPC server instrumentation DoS vulnerabilityMaven · io.micrometer:micrometer-core · fixed in 1.16.6, 1.15.12
- CVE-2026-45581fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service ModeMaven · org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim · fixed in 2.5.10
- CVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular usersMaven · org.open-metadata:openmetadata-service · fixed in 1.12.4
- CVE-2026-11477hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirectMaven · org.hswebframework.web:hsweb-authorization-oauth2
- CVE-2026-11470hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversalMaven · org.hswebframework.web:hsweb-system-file
- CVE-2026-45300async-http-client: Cookie header not stripped on cross-origin redirectMaven · org.asynchttpclient:async-http-client · fixed in 3.0.10, 2.15.0
- CVE-2026-11400Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQLMaven · software.amazon.jdbc:aws-advanced-jdbc-wrapper · fixed in 4.0.1
- CVE-2026-9088Keycloak: keycloak: information disclosure due to user profile permission bypassMaven · org.keycloak:keycloak-services · fixed in 26.7.0
- CVE-2026-48480netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.22.Final
- CVE-2026-48040netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory AccessMaven · io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl · fixed in 0.0.22.Final
- CVE-2026-41207netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failuresMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.21.Final
- CVE-2026-50076Apache Fory: Java ReplaceResolverSerializer deserialization checks bypassMaven · org.apache.fory:fory-core · fixed in 1.1.0
- CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232Maven · org.apache.mina:mina-core · fixed in 2.2.8, 2.1.13, 2.0.29
- CVE-2026-46718Apache Calcite: A user-controled model can load arbitrary classes, leading to code executionMaven · org.apache.calcite:calcite-core · fixed in 1.42.0
- CVE-2026-40990Unbounded cache for function definitionsMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 4.3.3, 5.0.2
- CVE-2026-40989Self Routing guard bypassed via function compositionMaven · org.springframework.cloud:spring-cloud-function-context · fixed in 4.3.3, 5.0.2
- CVE-2026-10532Logback deserialization whitelist bypass for Proxy objectsMaven · ch.qos.logback:logback-core · fixed in 1.5.34
- CVE-2026-49328Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRFMaven · org.apache.fesod:fesod-sheet · fixed in 2.0.2-incubating
- CVE-2026-48827Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-gitMaven · org.apache.sshd:sshd-git · fixed in 2.18.0, 3.0.0-M4
- CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersMaven · org.apache.solr:solr-core
- CVE-2026-49361Apache Fluss Netty Frame Decoder Memory Exhaustion VulnerabilityMaven · org.apache.fluss:fluss-common · fixed in 0.9.1-incubating
- CVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message PropertiesMaven · org.apache.activemq:activemq-web, org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6
- CVE-2026-42588Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-45505Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-46605Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removalMaven · org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6
- CVE-2026-49157Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by defaultMaven · org.apache.activemq:apache-activemq · fixed in 5.19.7, 6.2.6
- CVE-2026-49270Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)Maven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.7, 6.2.6
- CVE-2026-35563Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostnameMaven · org.apache.directory.api:api-ldap-client-api · fixed in 2.1.8
- CVE-2026-45609mcp-security: Unvalidated URL Fetching (SSRF)Maven · org.springaicommunity:mcp-client-security · fixed in 0.1.9