Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45292opentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationMaven · io.opentelemetry:opentelemetry-api, io.opentelemetry:opentelemetry-extension-trace-propagators · fixed in 1.62.0
- CVE-2026-44672mapfish-print: Remote Code Injection (RCE) in Dynamic tableMaven · org.mapfish.print:print-lib, org.mapfish.print:print-servlet · fixed in 3.28.28, 3.30.30, 3.31.21 and more
- CVE-2026-9828Logback deserialization whitelist bypass for java.lang and java.utilMaven · ch.qos.logback:logback-core · fixed in 1.5.33
- CVE-2026-40914Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permissionMaven · org.apache.artemis:artemis-stomp-protocol · fixed in 2.54.0
- CVE-2025-48977Apache Ignite: REST HTTP arbitrary file read vulnerabilityMaven · org.apache.ignite:ignite-core · fixed in 2.18.0
- CVE-2026-9802Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9803Keycloak: keycloak: denial of service via malformed authorization headerMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9801Keycloak: keycloak: denial of service via malformed ldap password policy responseMaven · org.keycloak:keycloak-ldap-federation · fixed in 26.6.3
- CVE-2026-9798Keycloak: keycloak: brute-force protection bypass in ciba flowMaven · org.keycloak:keycloak-services
- CVE-2026-9796Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityMaven · org.keycloak:keycloak-server · fixed in 26.6.4
- CVE-2026-9795Keycloak: keycloak: privilege escalation via improper scope mapping enforcementMaven · org.keycloak:keycloak-services · fixed in 26.6.4
- CVE-2026-9794Keycloak: keycloak: information disclosure via saml ecp endpointMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processingMaven · org.keycloak:keycloak-services
- CVE-2026-9791Keycloak-rhel9: organization data leak after feature disabled in keycloakMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-45083Goobi viewer: Unauthenticated Solr Streaming Expression ProxyMaven · io.goobi.viewer:viewer-core
- CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failMaven · org.jenkins-ci.plugins:jenkins-multijob-plugin · fixed in 669.v9d96a
- CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityMaven · org.jenkins-ci.plugins:buildgraph-view
- CVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OMaven · org.jenkins-ci.plugins:job-import-plugin · fixed in 143.145.v48f9a
- CVE-2026-48925A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trMaven · org.jenkins-ci.plugins:github-integration-parent · fixed in 0.7.4
- CVE-2026-48924Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacMaven · org.jenkins-ci.plugins:bitbucket-oauth · fixed in 0.18
- CVE-2026-48923Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackersMaven · com.rapid7:jenkinsci-appspider-plugin · fixed in 1.0.18
- CVE-2026-48922Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 725.ve52b
- CVE-2026-48921Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aMaven · io.jenkins.plugins:pipeline-groovy-lib · fixed in 798.v5cc688825312
- CVE-2026-48920Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlinMaven · org.jenkins-ci.plugins:email-ext · fixed in 1933.1935.v276319e3cc47
- CVE-2026-48919Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.41.1
- CVE-2026-48918Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.Maven · org.jenkins-ci.plugins:active-directory · fixed in 2.41.1
- CVE-2026-48917Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.Maven · org.jenkins-ci.plugins:ldap · fixed in 807.809.vd3a
- CVE-2026-48916Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.Maven · org.jenkins-ci.plugins:ldap · fixed in 807.809.vd3a
- CVE-2026-9704Keycloak: keycloak: privilege escalation due to oversized subject_token jwtMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 26.6.3