Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-44242Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language HeaderMaven · io.micronaut:micronaut-inject · fixed in 4.10.22, 3.10.6, 3.8.14
- CVE-2026-44221ArcadeDB: Cross-database authorization bypass and unsecured newly-created databasesMaven · com.arcadedb:arcadedb-server · fixed in 26.4.2
- CVE-2026-33117Azure SDK for Java Security Feature Bypass VulnerabilityMaven · com.azure:azure-security-keyvault-keys · fixed in 4.10.6
- CVE-2026-43515Apache Tomcat: Security constraints not correctly appliedMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant timeMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitiveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown userMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validatedMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-42498Apache Tomcat: WebSocket authentication header exposureMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.118, 10.1.55, 11.0.22
- CVE-2026-45091sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)Maven · io.github.davidalmeidac:sealed-env-core · fixed in 0.1.0-alpha.4
- CVE-2026-41713Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisorMaven · org.springframework.ai:spring-ai-client-chat · fixed in 1.0.7, 1.1.6
- CVE-2026-41712ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakageMaven · org.springframework.ai:spring-ai-advisors-vector-store, org.springframework.ai:spring-ai-client-chat +1 · fixed in 1.0.7, 1.1.6, 2.0.0-M6
- CVE-2026-42188Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URLMaven · org.geysermc.geyser:core · fixed in 2.9.3
- CVE-2026-42333quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operationsMaven · io.quarkiverse.openapi.generator:quarkus-openapi-generator · fixed in 2.16.0-lts, 2.17.0
- CVE-2026-41705Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.Maven · org.springframework.ai:spring-ai-milvus-store, org.springframework.ai:spring-ai-typesense-store · fixed in 1.0.7, 1.1.6
- CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverMaven · com.amazon.redshift:redshift-jdbc42 · fixed in 2.2.2
- CVE-2026-41883OmniFaces: EL injection via crafted resource name in wildcard CDN mappingMaven · org.omnifaces:omnifaces · fixed in 1.14.2, 2.7.32, 3.14.16 and more
- CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientServiceMaven · org.apache.nifi:nifi-other-graph-services-nar · fixed in 2.9.0
- CVE-2026-8149GCM chunking can lead to bad tag exception on decryptionMaven · org.bouncycastle:bcprov-lts8on · fixed in 2.73.11
- CVE-2023-42343A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on Maven · org.opencms:opencms-core · fixed in 10.5.1
- CVE-2023-42345A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2023-42346Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.Maven · org.opencms:opencms-core · fixed in 16.0
- CVE-2026-41586ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCEMaven · org.hyperledger.fabric-sdk-java:fabric-sdk-java
- CVE-2026-40981When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentiaMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41002The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41004When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.Maven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-40982Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.Maven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.3, 5.0.3
- CVE-2026-41417Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()Maven · io.netty:netty-codec-http · fixed in 4.1.133.Final, 4.2.13.Final