Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-39973Apktool: Path Traversal to Arbitrary File WriteMaven · org.apktool:apktool-lib · fixed in 3.0.2
- CVE-2026-32613Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handlingMaven · io.spinnaker.echo:echo-pipelinetriggers · fixed in 2026.0.1, 2025.4.2, 2025.3.2
- CVE-2026-32604Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and pathsMaven · io.spinnaker.clouddriver:clouddriver-artifacts-gitrepo · fixed in 2026.0.1
- CVE-2026-41245Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name PrefixMaven · com.github.junrar:junrar · fixed in 7.5.10
- CVE-2026-33557Apache Kafka: Missing JWT token validation in OAUTHBEARER authenticationMaven · org.apache.kafka:kafka-clients · fixed in 4.1.2
- CVE-2026-33558Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log OutputMaven · org.apache.kafka:kafka-clients · fixed in 3.9.2, 4.0.1
- CVE-2026-40490AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsMaven · org.asynchttpclient:async-http-client · fixed in 3.0.9, 2.14.5
- CVE-2026-35582Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixMaven · gov.nsa.emissary:emissary · fixed in 8.43.0
- CVE-2026-40478Improper neutralization of specific syntax patterns for unauthorized expressions in ThymeleafMaven · org.thymeleaf:thymeleaf, org.thymeleaf:thymeleaf-spring5 +1 · fixed in 3.1.4.RELEASE
- CVE-2026-40477Improper restriction of the scope of accessible objects in Thymeleaf expressionsMaven · org.thymeleaf:thymeleaf, org.thymeleaf:thymeleaf-spring5 +1 · fixed in 3.1.4.RELEASE
- CVE-2026-40458Cross-Site Request Forgery in PAC4JMaven · org.pac4j:pac4j-core · fixed in 5.7.10, 6.4.1
- CVE-2026-34164Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingServiceMaven · com.ritense.valtimo:inbox · fixed in 13.22.0.RELEASE
- CVE-2026-30778Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.Maven · org.apache.skywalking:server-core · fixed in 10.4.0
- CVE-2026-3505Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.Maven · org.bouncycastle:bcpg-jdk12, org.bouncycastle:bcpg-jdk14 +5 · fixed in 1.84
- CVE-2026-5588PKIX draft CompositeVerifier accepts empty signature sequence as valid.Maven · org.bouncycastle:bcpkix-debug-jdk14, org.bouncycastle:bcpkix-debug-jdk15to18 +5 · fixed in 1.84
- CVE-2026-5598Non-constant time comparisons risk private key leakage in FrodoKEM.Maven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 +1 · fixed in 1.84, 1.80.2
- CVE-2026-0636LDAP Injection Vulnerability in LDAPStoreHelper.javaMaven · org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15to18 +1 · fixed in 1.84
- CVE-2025-14813GOSTCTR implementation unable to process more than 255 blocks correctlyMaven · org.bouncycastle:bcprov-debug-jdk14, org.bouncycastle:bcprov-debug-jdk15on +12 · fixed in 1.84, 1.80.2, 1.81.1
- CVE-2026-40105XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionalityMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 16.10.16, 17.4.8, 17.10.1
- CVE-2026-40104XWiki's REST APIs can list all pages/spaces, leading to unavailabilityMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.10.16, 17.4.8, 17.10.1
- CVE-2026-39842OpenRemote is Vulnerable to Expression InjectionMaven · io.openremote:openremote-manager · fixed in 1.22.0
- CVE-2026-37980Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageMaven · org.keycloak:keycloak-services
- CVE-2026-2332HTTP Request Smuggling via Chunked Extension Quoted-String ParsingMaven · org.eclipse.jetty:jetty-http · fixed in 12.1.7, 12.0.33, 11.0.29 and more
- CVE-2026-33929Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeMaven · org.apache.pdfbox:pdfbox-examples · fixed in 2.0.37, 3.0.8
- CVE-2026-35337Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential HandlingMaven · org.apache.storm:storm-client · fixed in 2.8.6
- CVE-2026-35565Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UIMaven · org.apache.storm:storm-webapp · fixed in 2.8.6
- CVE-2026-6125Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injectionMaven · org.dromara.warm:warm-flow-plugin-modes-sb · fixed in 1.8.5
- CVE-2026-40180Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper classMaven · io.quarkiverse.openapi.generator:quarkus-openapi-generator · fixed in 2.16.0
- CVE-2026-34481Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayoutMaven · org.apache.logging.log4j:log4j-layout-template-json · fixed in 2.25.4
- CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4