Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-0858Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of iMaven · net.sourceforge.plantuml:plantuml · fixed in 1.2026.0
- CVE-2026-1002Eclipse Vert.x Web static handler file access denialMaven · io.vertx:vertx-core · fixed in 4.5.24, 5.0.7
- CVE-2026-0976Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsMaven · org.keycloak:keycloak-quarkus-server
- CVE-2025-66169Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j componentMaven · org.apache.camel:camel-neo4j · fixed in 4.10.8, 4.14.3, 4.17.0
- CVE-2025-68925Jervis has a JWT Algorithm Confusion VulnerabilityMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68704Jervis has a Weak Random for Timing Attack MitigationMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68703Jervis has a Salt for PBKDF2 derived from passwordMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68702Jervis has a SHA-256 Hex String Padding BugMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68701Jervis has Deterministic AES IV Derivation from PassphraseMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68931Jervis has AES CBC Mode Without AuthenticationMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68698Jervis has an RSA PKCS#1 v1.5 Padding VulnerabilityMaven · net.gleske:jervis · fixed in 2.2
- CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork componentMaven · com.opensymphony:xwork, org.apache.struts.xwork:xwork-core +1 · fixed in 6.1.1
- CVE-2025-65091XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONServiceMaven · org.xwiki.contrib:macro-fullcalendar-pom · fixed in 2.4.5
- CVE-2025-65090XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONServiceMaven · org.xwiki.contrib:macro-fullcalendar-pom · fixed in 2.4.6
- CVE-2025-70974Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a JavaMaven · com.alibaba:fastjson · fixed in 1.2.48
- CVE-2026-22244OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCEMaven · org.open-metadata:platform · fixed in 1.11.4
- CVE-2026-0707Keycloak: keycloak authorization header parsing leading to potential security control bypassMaven · org.keycloak:keycloak-parent
- CVE-2026-22187Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache FilesMaven · ome:pom-bio-formats
- CVE-2026-22186Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata ParserMaven · ome:pom-bio-formats
- CVE-2025-66560Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to writeMaven · io.quarkus:quarkus-rest · fixed in 3.20.5, 3.27.2, 3.31.0
- CVE-2025-12543Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfMaven · io.undertow:undertow-core · fixed in 2.3.21.Final, 2.2.39.Final
- CVE-2025-61916Spinnaker vulnerable to SSRF due to improper restrictions on http from user inputMaven · io.spinnaker.clouddriver:clouddriver-artifacts · fixed in 2025.1.6, 2025.2.3
- CVE-2025-68280Apache SIS: XML External Entity (XXE) vulnerabilityMaven · org.apache.sis.core:sis-metadata · fixed in 1.6
- CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalizationMaven · org.apache.kyuubi:kyuubi-server_2.12 · fixed in 1.10.3
- CVE-2025-15022Cross-site scripting in Action captionMaven · com.vaadin:vaadin, com.vaadin:vaadin-server +1 · fixed in 23.6.6, 24.8.14, 24.9.7 and more
- CVE-2026-21452MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload AllocationMaven · org.msgpack:msgpack-core · fixed in 0.9.11
- CVE-2025-47411Apache StreamPipes: Leverage of User ID for Privilege EscalationMaven · org.apache.streampipes:streampipes-parent · fixed in 0.98.0
- CVE-2025-11419Keycloak: keycloak tls client-initiated renegotiation denial of serviceMaven · org.keycloak:keycloak-quarkus-dist · fixed in 26.0.16, 26.2.10, 26.4.1
- CVE-2025-66524Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject ProcessorMaven · org.apache.nifi:nifi-asana-processors · fixed in 2.7.0
- CVE-2025-68390Elasticsearch Allocation of Resources Without Limits or ThrottlingMaven · org.elasticsearch.plugin:x-pack-core · fixed in 8.19.8, 9.1.8, 9.2.2