Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-2366Keycloak: keycloak: information disclosure via authorization bypass in admin apiMaven · org.keycloak:keycloak-js-admin-client
- CVE-2026-27478Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User ImpersonationMaven · io.unitycatalog:unitycatalog-server · fixed in 0.4.1
- CVE-2026-3429Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiMaven · org.keycloak:keycloak-services
- CVE-2026-3911Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpointMaven · org.keycloak:keycloak-services
- CVE-2026-2742Unauthorized session creation via reserved framework path accessMaven · com.vaadin:flow-server, com.vaadin:vaadin · fixed in 14.14.1, 23.6.7, 24.9.8 and more
- CVE-2026-2741Zip Slip Path Traversal on Node UnpackMaven · com.vaadin:flow-project · fixed in 14.14.1, 23.6.7, 24.9.9 and more
- CVE-2026-23907Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeMaven · org.apache.pdfbox:pdfbox-examples · fixed in 3.0.7
- CVE-2026-24713Apache IoTDB: JEXL Expression Injection VulnerabilityMaven · org.apache.iotdb:iotdb-core · fixed in 1.3.7, 2.0.7
- CVE-2026-24015Apache IoTDB: Insecure Default Configuration VulnerabilityMaven · org.apache.iotdb:iotdb-core · fixed in 1.3.7, 2.0.7
- CVE-2026-24308Apache ZooKeeper: Sensitive information disclosure in client configuration handlingMaven · org.apache.zookeeper:zookeeper · fixed in 3.9.5, 3.8.6
- CVE-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerMaven · org.apache.zookeeper:zookeeper · fixed in 3.8.6, 3.9.5
- CVE-2026-29062jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionMaven · tools.jackson.core:jackson-core · fixed in 3.1.0
- CVE-2026-22723UAA User Token Revocation logic errorMaven · org.cloudfoundry.identity:cloudfoundry-identity-server · fixed in 78.8.0
- CVE-2026-3047Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginMaven · org.keycloak:keycloak-broker-saml
- CVE-2026-3009Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)Maven · org.keycloak:keycloak-services · fixed in 26.5.5
- CVE-2026-1605In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Maven · org.eclipse.jetty:jetty-server · fixed in 12.1.6, 12.0.32
- CVE-2025-11143The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs.Maven · org.eclipse.jetty:jetty-http · fixed in 12.0.31, 12.1.5
- CVE-2026-29000pac4j-jwt JwtAuthenticator Authentication BypassMaven · org.pac4j:pac4j-jwt · fixed in 6.3.3, 5.7.9, 4.5.9
- CVE-2025-66024XWiki Blog Application home page vulnerable to Stored XSS via Post TitleMaven · org.xwiki.contrib.blog:application-blog-ui · fixed in 9.15.7
- CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationMaven · org.apache.activemq:artemis-server, org.apache.artemis:artemis-server · fixed in 2.52.0
- CVE-2025-66168Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validatedMaven · org.apache.activemq:activemq-all, org.apache.activemq:activemq-mqtt +1 · fixed in 5.19.2, 6.1.9, 6.2.1
- CVE-2025-59060Apache Ranger: Hostname verification bypass in NiFiRegistryClientMaven · org.apache.ranger:ranger-nifi-registry-plugin · fixed in 2.8.0
- CVE-2025-59059Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreatorMaven · org.apache.ranger:ranger-plugins-common · fixed in 2.8.0
- CVE-2026-28338PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messagesMaven · net.sourceforge.pmd:pmd-core · fixed in 7.22.0
- CVE-2025-12150Org.keycloak/keycloak-services: webauthn attestation statement verification bypassMaven · org.keycloak:keycloak-services · fixed in 26.4.4
- CVE-2026-0871Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsMaven · org.keycloak:keycloak-server-spi-private · fixed in 26.5.2
- CVE-2026-3293snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redosMaven · net.snowflake:snowflake-jdbc
- CVE-2026-3270psi-probe PSI Probe Whois Whois.java lookup server-side request forgeryMaven · com.github.psi-probe:psi-probe-core
- CVE-2026-3269psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of serviceMaven · com.github.psi-probe:psi-probe-core
- CVE-2026-28208Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/UnixMaven · com.github.junrar:junrar · fixed in 7.5.8