Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inMaven · org.apache.wicket:wicket-core
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationMaven · org.apache.wicket:wicket-auth-roles
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentMaven · org.apache.wicket:wicket-core
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredMaven · org.apache.wicket:wicket-core
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionMaven · org.apache.wicket:wicket-core
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-120135Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by defaultMaven · org.apache.thrift:libthrift · fixed in 0.24.0
- CVE-2026-118636Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderMaven · org.apache.mina:mina-core
- CVE-2026-63224OpenRemote has authenticated SQL injection in crosstab datapoint exportsMaven · io.openremote:openremote-manager · fixed in 1.26.0
- CVE-2026-61586Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)Maven · eu.copernik:copernik-xml-factory · fixed in 0.1.2
- CVE-2026-46560OpenAM Authentication Bypass via RADIUS SpoofingMaven · org.openidentityplatform.openam:openam-radius · fixed in 16.1.1
- CVE-2026-45049OpenAM Session Hijacking via CDSSOMaven · org.openidentityplatform.openam:openam-federation · fixed in 16.1.1
- CVE-2026-119281MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119280MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengthsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119279MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.10
- CVE-2026-119276MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-119210MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server…Maven · org.mariadb.jdbc:mariadb-java-client · fixed in 3.3.7, 3.4.5, 3.5.11
- CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingMaven · io.opentelemetry:opentelemetry-api · fixed in 1.67.0
- CVE-2026-114349Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesMaven · org.apache.kafka:kafka_2.11, org.apache.kafka:kafka_2.12 +1 · fixed in 2.5.0, 4.0.0
- CVE-2026-112375Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsMaven · org.apache.kafka:kafka
- CVE-2026-116593Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointMaven · org.apache.kafka:connect-runtime · fixed in 4.2.2, 4.3.2
- CVE-2026-115644Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST ExtensionsMaven · org.apache.kafka:connect-runtime · fixed in 4.2.2, 4.3.2
- CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationMaven · org.apache.kafka:kafka-clients, org.apache.kafka:kafka-streams
- CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationMaven · org.apache.kafka:kafka-streams
- CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingMaven · org.apache.kafka:kafka
- CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersMaven · org.apache.kafka:kafka
- CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of…Maven · org.apache.kafka:kafka
- CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredMaven · org.apache.kafka:kafka