Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604Maven · org.keycloak:keycloak-services
- CVE-2026-44900epa4all-client: VAU Signature bypassMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.1
- CVE-2026-45574epa4all-client: TLS Certificate Validation Disabled in ProductionMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.2
- CVE-2026-45575epa4all-client: Improper Verification of Cryptographic SignatureMaven · com.oviva.telematik:epa4all-client · fixed in 1.2.2
- CVE-2026-47672epa4all-client: Unauthenticated REST API for Patient Record WritesMaven · com.oviva.telematik:epa4all-rest-service
- CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowMaven · org.apache.shiro:shiro-jakarta-ee · fixed in 2.2.1, 3.0.0-alpha-2
- CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)Maven · org.apache.shiro:shiro-jakarta-ee · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultMaven · org.apache.shiro:shiro-web · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-43827Apache Shiro: Session fixation: new session is not created after login by defaultMaven · org.apache.shiro:shiro-core · fixed in 2.2.0, 3.0.0-alpha-2
- CVE-2026-9497changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserializationMaven · org.mengyun:tcc-transaction
- CVE-2026-42797Apache Syncope: JexlContextBuilder Information DisclosureMaven · org.apache.syncope.core:syncope-core-provisioning-api · fixed in 4.0.6, 4.1.1
- CVE-2026-42782Apache Syncope: Post-auth RCE via Groovy staticMaven · org.apache.syncope.core:syncope-core-spring · fixed in 4.0.6, 4.1.1
- CVE-2026-41863LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APIMaven · org.springframework.ai:spring-ai-anthropic · fixed in 1.1.7
- CVE-2026-9370ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable saltMaven · com.github.ulisesbocchio:jasypt-spring-boot, com.github.ulisesbocchio:jasypt-spring-boot-starter
- CVE-2026-44417Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)Maven · org.apache.cxf:cxf-rt-transports-jms · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-44618Apache CXF: XXE vulnerability in WS-Transfer functionalityMaven · org.apache.cxf:cxf-rt-ws-transfer · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryMaven · org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap · fixed in 4.2.1, 4.1.6, 3.6.11
- CVE-2026-33137XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}Maven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 16.10.17, 17.4.9, 17.10.3 and more
- CVE-2026-23734XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashMaven · org.xwiki.commons:xwiki-commons-classloader-api · fixed in 16.10.17, 17.4.9, 17.10.3 and more
- CVE-2026-9087Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-6009Jaspersoft Library Deserialisation VulnerabilityMaven · net.sf.jasperreports:jasperreports · fixed in 7.0.7
- CVE-2026-2586An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.Maven · org.glassfish.jsftemplating:jsftemplating, org.glassfish.main.admingui:console-common · fixed in 4.2.0, 8.0.2
- CVE-2026-2587A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gaMaven · org.glassfish.jsftemplating:jsftemplating, org.glassfish.main.admingui:admingui · fixed in 4.2.0, 8.0.2
- CVE-2026-47323Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringMaven · org.apache.camel:camel-cxf-rest · fixed in 4.14.6, 4.18.2
- CVE-2026-7860Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend BuildMaven · com.vaadin:flow-gradle-plugin, com.vaadin:flow-maven-plugin +1 · fixed in 24.9.18, 24.10.4, 25.0.12 and more
- CVE-2026-7571Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7507Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7504Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-37982Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-37979Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassMaven · org.keycloak:keycloak-services · fixed in 26.6.2