Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40076OpenMRS Core arbitrary file write and code execution via Zip Slip in module uploadMaven · org.openmrs.web:openmrs-web
- CVE-2026-6860A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard nameMaven · io.vertx:vertx-core · fixed in 4.5.27, 5.0.12
- CVE-2026-40010Apache Wicket: possible session fixation using AuthenticatedWebSessionMaven · org.apache.wicket:wicket-auth-roles · fixed in 10.9.0
- CVE-2026-42509Apache Wicket: crafted strings can break out of the JavaScript sequenceMaven · org.apache.wicket:wicket-parent · fixed in 10.9.0
- CVE-2026-43646Apache Wicket: crafted URLs can bypass PackageResourceGuardMaven · org.apache.wicket:wicket-parent · fixed in 10.9.0
- CVE-2026-43975Apache Wicket: Possible malicious path traversal in FolderUploadsFileManagerMaven · org.apache.wicket:wicket-core · fixed in 10.9.0
- CVE-2026-40075OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServletMaven · org.openmrs.web:openmrs-web · fixed in 2.8.6
- CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistencyMaven · io.quarkus:quarkus-vertx-http · fixed in 3.20.6.1, 3.27.3.1, 3.33.1.1 and more
- CVE-2026-7412In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URMaven · org.eclipse.basyx:basyx.sdk · fixed in 2.0.0-milestone-10
- CVE-2026-7411In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauMaven · org.eclipse.basyx:basyx.sdk · fixed in 2.0.0-milestone-10
- CVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verificationMaven · org.apache.thrift:libthrift · fixed in 0.23.0
- CVE-2026-42140Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameterMaven · org.xwiki.contrib.plantuml:macro-plantuml-macro · fixed in 2.4.1
- CVE-2026-40682Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorMaven · org.apache.opennlp:opennlp-tools · fixed in 2.5.9, 3.0.0-M3, 1.9.5
- CVE-2026-42810Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table namesMaven · org.apache.polaris:polaris-core · fixed in 1.4.1
- CVE-2026-42027Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderMaven · org.apache.opennlp:opennlp-tools · fixed in 2.5.9, 3.0.0-M3, 1.9.5
- CVE-2026-42440Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReaderMaven · org.apache.opennlp:opennlp-tools · fixed in 2.5.9, 3.0.0-M3, 1.9.5
- CVE-2026-42811Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditionsMaven · org.apache.polaris:polaris-core · fixed in 1.4.1
- CVE-2026-42809Apache Polaris: staged table creation could vend storage credentials for unvalidated locationsMaven · org.apache.polaris:polaris-runtime-service · fixed in 1.4.1
- CVE-2026-42812Apache Polaris: No protection on `write.metadata.path`Maven · org.apache.polaris:polaris-runtime-service · fixed in 1.4.1
- CVE-2026-40563Apache Atlas: Script injection allows access to unintended dataMaven · org.apache.atlas:apache-atlas · fixed in 2.5.0
- CVE-2026-6501Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External EntMaven · org.jopendocument:jopendocument
- CVE-2026-42778Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)Maven · org.apache.mina:mina-core · fixed in 2.1.12, 2.2.7
- CVE-2026-42779Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)Maven · org.apache.mina:mina-core · fixed in 2.1.12, 2.2.7
- CVE-2026-42404Apache Neethi: Unrestricted HTTP Redirect Following in Policy ReferencesMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-42402Apache Neethi: Policy Normalization Unbounded Resource Allocation DoSMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-42403Apache Neethi: Circular Policy Reference Infinite LoopMaven · org.apache.neethi:neethi · fixed in 3.2.2
- CVE-2026-7500Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabledMaven · org.keycloak:keycloak-services
- CVE-2026-36766Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackMaven · com.shopizer:shopizer
- CVE-2026-36767A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeablMaven · com.shopizer:shopizer
- CVE-2026-42198pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSMaven · org.postgresql:postgresql · fixed in 42.7.11