Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypassMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.4
- CVE-2026-39304Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-broker +2 · fixed in 5.19.4, 6.2.4
- CVE-2026-22750SSL bundle configuration silently bypassed in Spring Cloud GatewayMaven · org.springframework.cloud:spring-cloud-gateway · fixed in 4.2.1
- CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledMaven · org.apache.tomcat:tomcat-coyote-ffm · fixed in 9.0.117, 10.1.54, 11.0.21
- CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer tokenMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.117, 10.1.54, 11.0.21
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-tribes · fixed in 11.0.21, 10.1.54, 9.0.117
- CVE-2026-34483Apache Tomcat: Incomplete escaping of JSON access logsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.116, 10.1.54, 11.0.21
- CVE-2026-32990Apache Tomcat: Fix for CVE-2025-66614 is incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.116, 10.1.53, 11.0.20
- CVE-2026-29146Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-tribes · fixed in 9.0.116, 10.1.53, 11.0.20
- CVE-2026-29145Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledMaven · org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-coyote-ffm · fixed in 9.0.116, 10.1.53, 11.0.20
- CVE-2026-29129Apache Tomcat: TLS cipher order is not preservedMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.116, 10.1.53, 11.0.20
- CVE-2026-25854Apache Tomcat: Occasionally open redirectMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 9.0.116, 10.1.53, 11.0.20
- CVE-2026-24880Apache Tomcat: Request smuggling via invalid chunk extensionMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.116, 10.1.52, 11.0.20
- CVE-2026-40046Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validatedMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-mqtt +1 · fixed in 6.2.4
- CVE-2026-33005Apache OpenMeetings: Insufficient checks in FileWebServiceMaven · org.apache.openmeetings:openmeetings-parent · fixed in 9.0.0
- CVE-2026-33266Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltMaven · org.apache.openmeetings:openmeetings-parent · fixed in 9.0.0
- CVE-2026-34020Apache OpenMeetings: Login Credentials Passed via GET Query ParametersMaven · org.apache.openmeetings:openmeetings-parent · fixed in 9.0.0
- CVE-2025-62188Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.Maven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.0
- CVE-2026-33229XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting APIMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 17.4.8, 17.10.1
- CVE-2026-5795In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.Maven · org.eclipse.jetty.ee10:jetty-ee10-jaspi, org.eclipse.jetty.ee11:jetty-ee11-jaspi +3 · fixed in 12.1.8, 12.0.34, 11.0.29 and more
- CVE-2026-35568MCP Java-SDK has a DNS Rebinding VulnerabilityMaven · io.modelcontextprotocol.sdk:mcp-core · fixed in 1.0.0
- CVE-2026-33439Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMMaven · org.openidentityplatform.openam:openam · fixed in 16.0.6
- CVE-2026-5739PowerJob OpenAPI Endpoint addWorkflowNode GroovyEvaluator.evaluate code injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-5736PowerJob detailPlus Endpoint InstanceController.java sql injectionMaven · tech.powerjob:powerjob-server-starter
- CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password HashingMaven · org.apache.cassandra:cassandra-all · fixed in 4.0.20, 4.1.11, 5.0.7
- CVE-2026-27315Apache Cassandra: cqlsh history sensitive information leakMaven · org.apache.cassandra:cassandra-all · fixed in 4.0.20
- CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypassMaven · org.apache.cassandra:cassandra-all · fixed in 5.0.7
- CVE-2026-35583Emissary has a Path Traversal via Blacklist Bypass in Configuration APIMaven · gov.nsa.emissary:emissary · fixed in 8.39.0