Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-1770Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:craftercms · fixed in 4.5.0
- CVE-2024-5986Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2025-13881Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin apiMaven · org.keycloak:keycloak-services · fixed in 26.5.2, 26.4.9
- CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacksMaven · io.undertow:undertow-core · fixed in 2.2.39.Final, 2.4.0.Beta1, 2.3.21.Final
- CVE-2026-24819An out-of-memory (OOM) issue in foxinmy/weixin4jMaven · com.foxinmy:weixin4j-base
- CVE-2026-24807Buffer Overflow Vulnerability in liuyueyi/quick-mediaMaven · com.github.liuyueyi.media:batik-codec-fix
- CVE-2026-24806Buffer Write Security Vulnerability in liuyueyi/quick-mediaMaven · com.github.liuyueyi.media:batik-codec-fix
- CVE-2026-24802Buffer Overflow Vulnerability in briandilley/jsonrpc4jMaven · com.github.briandilley.jsonrpc4j:jsonrpc4j · fixed in 1.7.0
- CVE-2026-24400AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertionMaven · org.assertj:assertj-core · fixed in 3.27.7
- CVE-2026-1190Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataMaven · org.keycloak:keycloak-services
- CVE-2025-14969Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectMaven · org.hibernate.reactive:hibernate-reactive-core · fixed in 4.2.1
- CVE-2016-15057Apache Continuum: Command injection leading to RCEMaven · org.apache.continuum:continuum
- CVE-2025-27821HDFS native client: Out of bounds write in URI parser of native HDFS clientMaven · org.apache.hadoop:hadoop-hdfs-native-client · fixed in 3.4.2
- CVE-2026-24656Apache Karaf: Decanter log-socket collector has deserialization vulnerabilityMaven · org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket · fixed in 2.12.0
- CVE-2026-24128XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error MessagesMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 16.10.12, 17.4.5, 17.8.0-rc-1
- CVE-2026-0603Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionMaven · org.hibernate:hibernate-core · fixed in 5.3.38
- CVE-2025-22234Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigationMaven · org.springframework.security:spring-security-core · fixed in 6.3.9, 6.4.5
- CVE-2026-1225Malicious logback.xml configuration file allows instantiation of arbitrary classesMaven · ch.qos.logback:logback-core · fixed in 1.5.25
- CVE-2026-22022Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPluginMaven · org.apache.solr:solr-core · fixed in 9.10.1
- CVE-2026-22444Apache Solr: Insufficient file-access checking in standalone core-creation requestsMaven · org.apache.solr:solr-core · fixed in 9.10.1
- CVE-2025-14083Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosureMaven · org.keycloak:keycloak-services
- CVE-2025-14559Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled usersMaven · org.keycloak:keycloak-services · fixed in 26.5.2, 26.4.9
- CVE-2026-1035Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionMaven · org.keycloak:keycloak-services
- CVE-2026-1180Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriMaven · org.keycloak:keycloak-adapter-core
- CVE-2025-64087A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackersMaven · fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker · fixed in 2.2.0
- CVE-2025-65482An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadinMaven · fr.opensagres.xdocreport:fr.opensagres.xdocreport.document · fixed in 2.0.4
- CVE-2025-59355Apache Linkis: Password ExposureMaven · org.apache.linkis:linkis-metadata · fixed in 1.8.0
- CVE-2025-29847Apache Linkis: Arbitrary File Read via Double URL Encoding BypassMaven · org.apache.linkis:linkis · fixed in 1.8.0
- CVE-2026-1050risesoft-y9 Digital-Infrastructure REST Authenticate Endpoint Y9PlatformUtil.java sql injectionMaven · net.risesoft:risenet-y9boot-support-platform-service
- CVE-2025-15104Nu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRFMaven · nu.validator:validator