Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-68384Elasticsearch Allocation of Resources Without Limits or ThrottlingMaven · org.elasticsearch.plugin:x-pack-security · fixed in 8.19.9, 9.1.9, 9.2.3
- CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appenderMaven · org.apache.logging.log4j:log4j-core · fixed in 2.25.3
- CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address headerMaven · org.webjars.npm:nodemailer
- CVE-2025-14763Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to intrMaven · software.amazon.encryption.s3:amazon-s3-encryption-client-java · fixed in 4.0.0
- CVE-2024-29371In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token wiMaven · org.bitbucket.b_c:jose4j · fixed in 0.9.6
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayMaven · org.altcha:altcha · fixed in 1.3.0
- CVE-2025-67735Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderMaven · io.netty:netty-codec-http · fixed in 4.2.8.Final, 4.1.129.Final
- CVE-2025-37731Elasticsearch Improper AuthenticationMaven · org.elasticsearch.plugin:x-pack-core, org.elasticsearch.plugin:x-pack-security · fixed in 8.19.8, 9.1.8, 9.2.2
- CVE-2025-14674aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injectionMaven · com.aizuda:snail-job · fixed in 1.7.0-beta1
- CVE-2025-67721Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output bufferMaven · io.airlift:aircompressor, io.airlift:aircompressor-v3 · fixed in 2.0.3, 3.4
- CVE-2025-53960Apache StreamPark: Uses the user’s password as the secret keyMaven · org.apache.streampark:streampark · fixed in 2.1.7
- CVE-2025-54947Apache StreamPark: Use hard-coded key vulnerabilityMaven · org.apache.streampark:streampark · fixed in 2.1.7
- CVE-2025-54981Apache StreamPark: Weak Encryption Algorithm in StreamParkMaven · org.apache.streampark:streampark · fixed in 2.1.7
- CVE-2025-26866Apache HugeGraph-Server: RAFT and deserialization vulnerabilityMaven · org.apache.hugegraph:hg-pd-core · fixed in 1.7.0
- CVE-2025-14518PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgeryMaven · tech.powerjob:powerjob-common
- CVE-2025-67505Race condition in the Okta Java SDKMaven · com.okta.sdk:okta-sdk-root · fixed in 20.0.1
- CVE-2025-66474XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionMaven · org.xwiki.rendering:xwiki-rendering-xml · fixed in 16.10.10, 17.4.3, 17.6.0-rc-1
- CVE-2025-66473XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikisMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 16.10.11, 17.4.4, 17.7.0-rc-1
- CVE-2025-66033Improper Memory Cleanup in the Okta Java SDKMaven · com.okta.sdk:okta-sdk-root · fixed in 24.0.1
- CVE-2025-66472XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationMaven · org.xwiki.platform:xwiki-platform-flamingo-skin-resources, org.xwiki.platform:xwiki-platform-web-templates · fixed in 16.10.10, 17.4.2
- CVE-2025-67643Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workMaven · org.jenkinsci.plugins:pipeline-reporter-by-redpen
- CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing aMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin
- CVE-2025-67641Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage resMaven · io.jenkins.plugins:coverage · fixed in 2.3056
- CVE-2025-67640Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a teMaven · org.jenkins-ci.plugins:git-client · fixed in 6.4.1
- CVE-2025-67639A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users intoMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.541, 2.528.3
- CVE-2025-67638Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.541, 2.528.3
- CVE-2025-67637Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins contMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.541, 2.528.3
- CVE-2025-67636A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypteMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.541, 2.528.3
- CVE-2025-67635Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corMaven · org.jenkins-ci.main:cli, org.jenkins-ci.main:jenkins-core · fixed in 2.541, 2.528.3
- CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedMaven · org.apache.struts:struts2-core · fixed in 6.8.0, 7.1.1