Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-28208Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/UnixMaven · com.github.junrar:junrar · fixed in 7.5.8
- CVE-2026-27830c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString propertyMaven · com.mchange:c3p0 · fixed in 0.12.0
- CVE-2026-27727mchange-commons-java: Remote Code Execution via JNDI Reference ResolutionMaven · com.mchange:mchange-commons-java · fixed in 0.4.0
- CVE-2026-25747Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDBMaven · org.apache.camel:camel-leveldb · fixed in 4.10.9, 4.14.5, 4.18.0
- CVE-2026-23552Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyMaven · org.apache.camel:camel-keycloak · fixed in 4.18.0
- CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission.Maven · org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 · fixed in 9.32.167
- CVE-2026-2733Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocolMaven · org.keycloak:keycloak-services
- CVE-2026-2666mingSoft MCMS Template Archive uploadTemplate.do unrestricted uploadMaven · net.mingsoft:ms-mcms
- CVE-2026-27100Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.551, 2.541.2
- CVE-2026-27099Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of Maven · org.jenkins-ci.main:jenkins-core · fixed in 2.551, 2.541.2
- CVE-2026-24734Apache Tomcat Native, Apache Tomcat: OCSP revocation bypassMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote +1 · fixed in 11.0.18, 10.1.52, 9.0.115
- CVE-2026-24733Apache Tomcat: Security constraint bypass with HTTP/0.9Maven · org.apache.tomcat:tomcat-coyote · fixed in 11.0.15, 10.1.50, 9.0.113
- CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mappingMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.15, 10.1.50, 9.0.113
- CVE-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component UpdatesMaven · org.apache.nifi:nifi-web-api · fixed in 2.8.0
- CVE-2025-33042Apache Avro Java SDK: Code injection on Java generated codeMaven · org.apache.avro:avro-compiler · fixed in 1.12.1, 1.11.5
- CVE-2026-26000XWiki Platform affected by click-jacking through CSS injection in commentsMaven · org.xwiki.platform:xwiki-platform-web · fixed in 17.9.0, 17.4.6, 16.10.13
- CVE-2026-26010Leaky JWTs in OpenMetadata exposing highly-privileged bot usersMaven · org.open-metadata:openmetadata-sdk · fixed in 1.11.8
- CVE-2025-11537Keycloak-services: sensitive headers shown in the http access logsMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.5.6
- CVE-2026-23906Apache Druid: Authentication Bypass via LDAP Anonymous BindMaven · org.apache.druid.extensions:druid-basic-security · fixed in 36.0.0
- CVE-2026-23901Apache Shiro: Brute force attack possible to determine valid user namesMaven · org.apache.shiro:shiro-core · fixed in 2.1.0
- CVE-2025-14778Keycloak: incorrect ownership checks in /uma-policy/Maven · org.keycloak:keycloak-services · fixed in 26.2.13, 26.5.3, 26.4.9
- CVE-2026-1529Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validationMaven · org.keycloak:keycloak-services · fixed in 26.5.3, 26.2.13, 26.4.9
- CVE-2026-1486Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grantMaven · org.keycloak:keycloak-services · fixed in 26.5.3, 26.4.9
- CVE-2026-23903Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystemsMaven · org.apache.shiro:shiro-spring, org.apache.shiro:shiro-web · fixed in 2.1.0, 2.0.7
- CVE-2026-1337Insufficient escaping of unicode characters in query logMaven · org.neo4j:neo4j · fixed in 2026.01
- CVE-2026-25526JinJava Bypass through ForTag leads to Arbitrary Java ExecutionMaven · com.hubspot.jinjava:jinjava · fixed in 2.8.3, 2.7.6
- CVE-2026-1622Unredacted data exposure in query.logMaven · org.neo4j:neo4j · fixed in 5.26.21, 2026.01.3
- CVE-2026-23794Apache Syncope: Reflected XSS on Enduser LoginMaven · org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui · fixed in 3.0.16, 4.0.4
- CVE-2026-23795Apache Syncope: Console XXE on Keymaster parametersMaven · org.apache.syncope.client.idrepo:syncope-client-idrepo-console · fixed in 3.0.16, 4.0.4
- CVE-2026-1770Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:craftercms · fixed in 4.5.0