Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-37978Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-7307Keycloak: keycloak: denial of service via specially crafted saml inputMaven · org.keycloak:keycloak-saml-core · fixed in 26.6.2
- CVE-2026-37981Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointMaven · org.keycloak:keycloak-services · fixed in 26.4.12, 26.6.2
- CVE-2026-4630Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceMaven · org.keycloak:keycloak-services · fixed in 26.6.2
- CVE-2026-8922Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesMaven · org.keycloak:keycloak-services
- CVE-2026-8830Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationMaven · org.keycloak:keycloak-services · fixed in 26.6.3
- CVE-2026-8771linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injectionMaven · org.linlinjava:litemall-wx-api
- CVE-2026-8759xiandafu beetl SpELFunction SpELFunction.java expression language injectionMaven · com.ibeetl:beetl-spring-classic
- CVE-2026-44714bitcoinj: ScriptExecution P2PKH/P2WPKH Verification BypassMaven · org.bitcoinj:bitcoinj-core · fixed in 0.17.1
- CVE-2026-41258OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRangeMaven · org.openmrs.api:openmrs-api · fixed in 2.7.9, 2.8.6
- CVE-2026-35194Apache Flink: Remote code execution via SQL injection in code generationMaven · org.apache.flink:flink-table-api-java, org.apache.flink:flink-table-planner_2.12 +1 · fixed in 1.20.4, 2.0.2, 2.1.2 and more
- CVE-2026-44516Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizerMaven · com.ritense.valtimo:web · fixed in 12.33.0, 13.26.0
- CVE-2026-42555Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin usersMaven · com.ritense.valtimo:case, com.ritense.valtimo:contract +1 · fixed in 13.23.0, 12.32.0
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectMaven · com.microsoft.kiota:microsoft-kiota-abstractions · fixed in 1.9.1
- CVE-2026-44308Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notificationsMaven · io.awspring.cloud:spring-cloud-aws-sns · fixed in 4.0.2
- CVE-2026-45205Apache Commons Configuration: StackOverflowError for YAML input with cyclesMaven · org.apache.commons:commons-configuration2 · fixed in 2.15.0
- CVE-2026-44248Netty: Resource exhaustion in MqttDecoderMaven · io.netty:netty-codec-mqtt · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42587Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSMaven · io.netty:netty-codec-http, io.netty:netty-codec-http2 · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42586Netty: CRLF Injection in Netty Redis Codec EncoderMaven · io.netty:netty-codec-redis · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42585Netty: HTTP Request Smuggling due to malformed Transfer-EncodingMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42584Netty: HttpClientCodec response desynchronizationMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42583Netty: Lz4FrameDecoder resource exhaustionMaven · io.netty:netty-codec, io.netty:netty-codec-compression · fixed in 4.1.133.Final, 4.2.13.Final
- CVE-2026-42582Netty: HTTP/3 QPACK literal unbounded allocationMaven · io.netty:netty-codec-http3 · fixed in 4.2.13.Final
- CVE-2026-42580Netty: HTTP Request Smuggling due to incorrect chunk size parsingMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42579Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)Maven · io.netty:netty-codec-dns · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-42577Netty: epoll transport denial of service via RST on half-closed TCP connectionMaven · io.netty:netty-transport-classes-epoll · fixed in 4.2.13.Final
- CVE-2026-42578Netty: HTTP Header Injection via HttpProxyHandler Disabled ValidationMaven · io.netty:netty-handler-proxy · fixed in 4.1.133.Final, 4.2.13.Final
- CVE-2026-42581Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationMaven · io.netty:netty-codec-http · fixed in 4.2.13.Final, 4.1.133.Final
- CVE-2026-41901Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsMaven · org.thymeleaf:thymeleaf, org.thymeleaf:thymeleaf-spring5 +1 · fixed in 3.1.5.RELEASE
- CVE-2026-44241Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language HeaderMaven · io.micronaut:micronaut-context · fixed in 4.10.22, 3.10.6, 3.8.14