Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowiMaven · org.jenkins-ci.plugins:azure-ad · fixed in 667.v4c5827a
- CVE-2026-42524Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site Maven · org.jenkins-ci.plugins:htmlpublisher · fixed in 427.1
- CVE-2026-42523Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featuMaven · com.coravy.hudson.plugins.github:github · fixed in 1.46.0.1
- CVE-2026-42522A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permMaven · org.jenkins-ci.plugins:github-branch-source · fixed in 1967.1969.v205fd594c821
- CVE-2026-42521Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifiMaven · org.jenkins-ci.plugins:matrix-auth · fixed in 3.2.10
- CVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing aMaven · org.jenkins-ci.plugins:credentials-binding · fixed in 720.v3f6decef43ea
- CVE-2026-42519A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:script-security · fixed in 1402.v94c9ce464861
- CVE-2026-22745CVE-2026-22745 : Denial of service in static resource handling on Windows platformsMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.7, 6.2.18
- CVE-2026-22741Static resource cache poisoning in Spring MVC and WebFluxMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.7, 6.2.18
- CVE-2026-22740Spring Framework DoS with Multipart Temp Files in WebFluxMaven · org.springframework:spring-webflux · fixed in 7.0.7, 6.2.18
- CVE-2026-7303Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injectionMaven · com.xuxueli:xxl-job-admin · fixed in 3.4.0
- CVE-2026-40969Spring gRPC AuthenticationException message reflected to remote clientMaven · org.springframework.grpc:spring-grpc · fixed in 1.0.3
- CVE-2026-40968Spring gRPC SecurityContext leaks across requests on authorization failureMaven · org.springframework.grpc:spring-grpc · fixed in 1.0.3
- CVE-2026-40980In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayMaven · org.springframework.ai:spring-ai-pdf-document-reader · fixed in 1.0.6, 1.1.5
- CVE-2026-40979In Spring AI, having access to a shared environment can expose the ONNX model used by the application.Maven · org.springframework.ai:spring-ai-transformers · fixed in 1.0.6, 1.1.5
- CVE-2026-40978SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.Maven · org.springframework.ai:spring-ai-azure-cosmos-db-store · fixed in 1.0.6, 1.1.5
- CVE-2026-40966VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltrationMaven · org.springframework.ai:spring-ai-advisors-vector-store · fixed in 1.0.6, 1.1.5
- CVE-2026-40967In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector storMaven · org.springframework.ai:spring-ai-vector-store · fixed in 1.0.6, 1.1.5
- CVE-2026-40977When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corruMaven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40976In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Maven · org.springframework.boot:spring-boot · fixed in 4.0.6
- CVE-2026-40975Values produced by ${random.value} are not suitable for use as secrets.Maven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40974Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Maven · org.springframework.boot:spring-boot-cassandra · fixed in 4.0.6, 3.5.14
- CVE-2026-40973A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.Maven · org.springframework.boot:spring-boot · fixed in 4.0.6, 3.5.14
- CVE-2026-40972An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seMaven · org.springframework.boot:spring-boot-devtools · fixed in 4.0.6, 3.5.14
- CVE-2026-40971When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thMaven · org.springframework.boot:spring-boot-rabbitmq · fixed in 4.0.6, 3.5.14
- CVE-2026-40970When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting Maven · org.springframework.boot:spring-boot-elasticsearch · fixed in 4.0.6
- CVE-2026-40557Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connectionsMaven · org.apache.storm:storm-metrics-prometheus · fixed in 2.8.7
- CVE-2026-41081Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failureMaven · org.apache.storm:storm-client · fixed in 2.8.7
- CVE-2026-27172Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeMaven · org.apache.camel:camel-consul · fixed in 4.14.6, 4.18.1
- CVE-2026-33453Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionMaven · org.apache.camel:camel-coap · fixed in 4.14.6, 4.18.1