Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-110952Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultMaven · org.apache.kafka:kafka · fixed in 4.4.0
- CVE-2026-83525Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller…Maven · org.apache.kafka:kafka-raft · fixed in 4.2.2, 4.3.2
- CVE-2026-44179XWiki Pro Macros: excerpt-include title and content injection executes codeMaven · com.xwiki.pro:xwiki-pro-macros · fixed in 1.14.5
- CVE-2026-110879jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation…Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-110747jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf, tools.jackson.dataformat:jackson-dataformat-protobuf · fixed in 2.21.8, 2.22.4, 3.1.8 and more
- CVE-2026-104895jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-smile, tools.jackson.dataformat:jackson-dataformat-smile · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-104016jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorMaven · com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf, tools.jackson.dataformat:jackson-dataformat-protobuf · fixed in 2.18.12, 2.21.8, 2.22.4 and more
- CVE-2026-110737Push Endpoint Returns Permissive CORS HeadersMaven · com.vaadin:flow-server, com.vaadin:vaadin +3 · fixed in 2.13.8, 23.6.16, 24.4.19 and more
- CVE-2026-116590snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.9
- CVE-2026-110748Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 filesMaven · org.apache.sis:sis-metadata
- CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)Maven · org.apache.camel:camel-docling · fixed in 4.18.5, 4.22.2
- CVE-2026-95629Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary DirectoryMaven · org.apache.camel:camel-docling · fixed in 4.18.5, 4.22.2
- CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by…Maven · org.apache.camel:camel-keycloak · fixed in 4.18.5, 4.22.2
- CVE-2026-101259Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-coap · fixed in 4.18.5, 4.22.2
- CVE-2026-113730OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxiesMaven · ognl:ognl · fixed in 3.4.13
- CVE-2026-111765A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixMaven · org.a2aproject.sdk:a2a-java-sdk-http-client-android · fixed in 1.3.2.Final
- CVE-2026-111764A2A Java SDK has a fail-open default task authorizationMaven · org.a2aproject.sdk:a2a-java-sdk-server-common · fixed in 1.3.0.Final
- CVE-2026-111763A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectMaven · org.a2aproject.sdk:a2a-java-sdk-parent · fixed in 1.3.0.Final
- CVE-2026-111762A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureMaven · org.a2aproject.sdk:a2a-java-sdk-transport-rest · fixed in 1.3.0.Final
- CVE-2026-111761A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryMaven · org.a2aproject.sdk:a2a-java-sdk-server-common · fixed in 1.3.0.Final
- CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code ExecutionMaven · org.apache.camel:camel-jgroups · fixed in 4.18.5, 4.22.1
- CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheMaven · org.apache.camel:camel-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingMaven · org.apache.camel:camel-platform-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-grpc · fixed in 4.18.5, 4.22.1
- CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of…Maven · org.apache.camel:camel-mail · fixed in 4.18.5, 4.22.1
- CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetMaven · org.apache.camel:camel-jetty · fixed in 4.18.5, 4.22.1
- CVE-2026-85312Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action HeaderMaven · org.apache.camel:camel-core · fixed in 4.18.5, 4.22.1
- CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateMaven · org.apache.camel:camel-as2 · fixed in 4.18.5, 4.22.1
- CVE-2026-85260Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by DefaultMaven · org.apache.camel:camel-mllp · fixed in 4.18.5, 4.22.1
- CVE-2026-85257Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-cxf · fixed in 4.18.5, 4.22.1