Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-33454Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)Maven · org.apache.camel:camel-mail · fixed in 4.14.6, 4.18.1
- CVE-2026-40022Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeMaven · org.apache.camel:camel-platform-http-main · fixed in 4.14.6, 4.18.2, 4.20.0
- CVE-2026-40858Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryMaven · org.apache.camel:camel-infinispan · fixed in 4.14.7, 4.18.2, 4.20.0
- CVE-2026-41409Apache MINA: CWE-502 Deserialization of Untrusted DataMaven · org.apache.mina:mina-core · fixed in 2.0.28, 2.1.11, 2.2.6
- CVE-2026-41635Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCEMaven · org.apache.mina:mina-core · fixed in 2.0.28, 2.1.11, 2.2.6
- CVE-2026-40453Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injectionMaven · org.apache.camel:camel-coap, org.apache.camel:camel-google-pubsub +2 · fixed in 4.14.6, 4.18.2, 4.20.0
- CVE-2026-40860Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpMaven · org.apache.camel:camel-activemq, org.apache.camel:camel-activemq6 +4 · fixed in 4.14.7, 4.18.2, 4.20.0
- CVE-2026-40048Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManagerMaven · org.apache.camel:camel-pqc · fixed in 4.20.0, 4.18.2
- CVE-2026-40473Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDPMaven · org.apache.camel:camel-mina · fixed in 4.14.6, 4.18.2, 4.20.0
- CVE-2026-7045baomidou dynamic-datasource StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injectionMaven · com.baomidou:dynamic-datasource-spring
- CVE-2026-33524Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in DeserializationMaven · io.github.ndsev:zserio-runtime · fixed in 2.18.1
- CVE-2026-23902Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.Maven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.4.1
- CVE-2025-62233Apache DolphinScheduler: Deserialization of untrusted data in RPCMaven · org.apache.dolphinscheduler:dolphinscheduler, org.apache.dolphinscheduler:dolphinscheduler-rpc · fixed in 3.3.1
- CVE-2026-41044Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by JolokiaMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.6, 6.2.5
- CVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queuesMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.6, 6.2.5
- CVE-2026-40466Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +1 · fixed in 5.19.6, 6.2.5
- CVE-2026-3960Remote Code Execution in h2oai/h2o-3Maven · ai.h2o:h2o-core · fixed in 3.46.0.10
- CVE-2026-40882OpenRemote has XXE in Velbus Asset ImportMaven · io.openremote:openremote-manager · fixed in 1.22.0
- CVE-2026-41166OpenRemote has Improper Access Control via updateUserRealmRoles functionMaven · io.openremote:openremote-manager · fixed in 1.22.1
- CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserializationMaven · org.apache.camel:camel-infinispan · fixed in 4.20.0
- CVE-2026-40542Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationMaven · org.apache.httpcomponents.client5:httpclient5 · fixed in 5.6.1
- CVE-2026-22754ervlet Path Not Correctly Included in Path Matching of XML Authorization RulesMaven · org.springframework.security:spring-security-config · fixed in 7.0.5
- CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersMaven · org.springframework.security:spring-security-config · fixed in 7.0.5
- CVE-2026-22748Potential Security Misconfiguration when Using withIssuerLocationMaven · org.springframework.security:spring-security-oauth2-jose · fixed in 6.5.10, 7.0.5
- CVE-2026-22747Unauthorized User Impersonation when Using X.509 Client CertificatesMaven · org.springframework.security:spring-security-web · fixed in 7.0.5
- CVE-2026-22746User Attribute Enumeration when Using DaoAuthenticationProviderMaven · org.springframework.security:spring-security-core · fixed in 6.5.10, 7.0.5
- CVE-2026-30139A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaMaven · org.silverpeas.core:silverpeas-core-war, org.silverpeas.core:silverpeas-core-web
- CVE-2026-40942DSF: Inverted Time Comparison in OIDC JWKS and Token CacheMaven · dev.dsf:dsf-bpe-process-api-v2, dev.dsf:dsf-bpe-server
- CVE-2026-40939DSF: Missing Session Timeout for OIDC SessionsMaven · dev.dsf:dsf-bpe-server, dev.dsf:dsf-common-jetty +1
- CVE-2026-22751Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsMaven · org.springframework.security:spring-security-core · fixed in 6.5.10, 7.0.5