Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4874Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulationMaven · org.keycloak:keycloak-services · fixed in 26.6.3, 26.4.13
- CVE-2025-67030Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2dMaven · org.codehaus.plexus:plexus-utils · fixed in 4.0.3, 3.6.1
- CVE-2025-70952pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names cMaven · org.pf4j:pf4j · fixed in 3.14.1
- CVE-2026-32948sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on WindowsMaven · org.scala-sbt:sbt · fixed in 1.12.8
- CVE-2026-32642Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permissionMaven · org.apache.activemq:artemis-openwire-protocol, org.apache.artemis:artemis-openwire-protocol · fixed in 2.53.0
- CVE-2026-22739Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF AttacksMaven · org.springframework.cloud:spring-cloud-config-server · fixed in 4.3.2, 5.0.2
- CVE-2026-4633Keycloak: keycloak: user enumeration via differential error messagesMaven · org.keycloak:keycloak-services · fixed in 26.6.1, 26.4.12
- CVE-2026-4628Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access controlMaven · org.keycloak:keycloak-services
- CVE-2026-33180HAPI FHIR HTTP authentication leak in redirectsMaven · ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 +10 · fixed in 6.9.0
- CVE-2026-33166Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)Maven · io.qameta.allure:allure-generator · fixed in 2.38.0
- CVE-2026-33013Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesMaven · io.micronaut:micronaut-json-core · fixed in 4.10.16, 3.10.5, 3.8.13
- CVE-2026-33012Micronaut Framework vulnerable to a Denial of Service in HTML error response cachingMaven · io.micronaut:micronaut-http-server · fixed in 4.10.17
- CVE-2026-22737Spring Framework Improper Path Limitation with Script View TemplatesMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.6, 6.2.17
- CVE-2026-22735Server Sent Event stream corruptionMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 7.0.6, 6.2.17
- CVE-2026-22733Authentication Bypass under Actuator CloudFoundry endpointsMaven · org.springframework.boot:spring-boot-starter-actuator · fixed in 4.0.4, 3.5.12
- CVE-2026-22732Under Some Conditions Spring Security HTTP Headers Are not WrittenMaven · org.springframework.security:spring-security-web · fixed in 6.5.9, 7.0.4
- CVE-2026-22731Authentication Bypass under Actuator Health groups pathsMaven · org.springframework.boot:spring-boot-starter-actuator · fixed in 3.5.12, 4.0.4
- CVE-2026-33004Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential Maven · org.jenkins-ci.plugins:loadninja · fixed in 2.2
- CVE-2026-33003Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they Maven · org.jenkins-ci.plugins:loadninja · fixed in 2.2
- CVE-2026-33002Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made tMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.555
- CVE-2026-33001Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.555
- CVE-2026-22729CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterMaven · org.springframework.ai:spring-ai-vector-store · fixed in 1.1.3, 1.0.4
- CVE-2026-22730CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterMaven · org.springframework.ai:spring-ai-mariadb-store · fixed in 1.1.3, 1.0.4
- CVE-2026-2575Keycloak: keycloak: denial of service due to excessive samlrequest decompressionMaven · org.keycloak:keycloak-saml-adapter-core, org.keycloak:keycloak-saml-core +1 · fixed in 26.5.4
- CVE-2026-2603Keycloak: keycloak: unauthorized authentication via disabled saml identity providerMaven · org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services · fixed in 26.5.5
- CVE-2026-2092Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsMaven · org.keycloak:keycloak-services
- CVE-2026-25534Spinnaker clouddriver and orca URL validation bypass via underscores in hostnamesMaven · io.spinnaker.clouddriver:clouddriver-artifacts, io.spinnaker.orca:orca-core · fixed in 2025.2.4, 2025.3.1, 2025.4.1
- CVE-2025-54920Apache Spark: Spark History Server Code Execution VulnerabilityMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11 +3 · fixed in 3.5.7, 4.0.1
- CVE-2025-60012Apache Livy: Restrict file accessMaven · org.apache.livy:livy-server · fixed in 0.9.0-incubating
- CVE-2025-66249Apache Livy: Unauthorized directory accessMaven · org.apache.livy:livy-server · fixed in 0.9.0-incubating