Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14082Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosureMaven · org.keycloak:keycloak-services · fixed in 26.5.0
- CVE-2025-14307Insecure Temporary File Creation in Robocode's AutoExtract ComponentMaven · net.sf.robocode:robocode.battle · fixed in 1.9.5.6
- CVE-2025-14306Directory Traversal in Robocode's CacheCleaner ComponentMaven · net.sf.robocode:robocode.core · fixed in 1.9.5.6
- CVE-2025-66623Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operandsMaven · io.strimzi:strimzi · fixed in 0.49.1
- CVE-2025-66566yawkat LZ4 Java has a possible information leak in Java safe decompressorMaven · at.yawk.lz4:lz4-java, net.jpountz.lz4:lz4 +2 · fixed in 1.10.1
- CVE-2025-66516Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affectedMaven · org.apache.tika:tika-core, org.apache.tika:tika-parser-pdf-module +1 · fixed in 3.2.2, 2.0.0
- CVE-2025-11222Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via sMaven · com.linecorp.centraldogma:centraldogma-server-auth-shiro · fixed in 0.78.0
- CVE-2025-66453Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() functionMaven · org.mozilla:rhino · fixed in 1.7.14.1, 1.7.15.1, 1.8.1
- CVE-2024-3884Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedMaven · io.undertow:undertow-core · fixed in 2.2.39.Final, 2.4.0.Beta1, 2.3.21.Final
- CVE-2025-13472Missing authorization in BlazeMeter Jenkins PluginMaven · com.blazemeter.plugins:blazemeterjenkinsplugin · fixed in 4.27
- CVE-2025-55749The XWiki Jetty package (XJetty) allows accessing any application file through URLMaven · org.xwiki.platform:xwiki-platform-tool-jetty-resources · fixed in 16.10.11, 17.4.4, 17.7.0
- CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)Maven · org.apache.struts:struts2-core · fixed in 6.8.0, 7.1.1
- CVE-2025-13806nutzam NutzBoot Transaction API EthModule.java improper authorizationMaven · org.nutz:nutzboot-parent
- CVE-2025-13805nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserializationMaven · org.nutz:nutzboot-parent
- CVE-2025-13804nutzam NutzBoot Ethereum Wallet EthModule.java information disclosureMaven · org.nutz:nutzboot-parent
- CVE-2025-12183org.lz4:lz4-java - Out-of-Bounds Memory AccessMaven · at.yawk.lz4:lz4-java, net.jpountz.lz4:lz4 +2 · fixed in 1.8.1
- CVE-2025-66372Mustang before 2.16.3 allows exfiltrating files via XXE attacks.Maven · org.mustangproject:library, org.mustangproject:validator · fixed in 2.16.3
- CVE-2025-54057Apache SkyWalking: Stored XSS vulnerabilityMaven · org.apache.skywalking:apm-webapp
- CVE-2025-59390Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.Maven · org.apache.druid:druid · fixed in 35.0.0
- CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIsMaven · org.apache.hive:hive-common, org.apache.hive:hive-metastore · fixed in 4.2.0
- CVE-2025-66021OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitizationMaven · com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer · fixed in 20260101.1
- CVE-2025-21621GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML formatMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-wms · fixed in 2.25.0
- CVE-2025-58360GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-wms · fixed in 2.26.2, 2.25.6
- CVE-2025-9624OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoSMaven · org.opensearch:opensearch-common · fixed in 3.3.0, 2.19.4
- CVE-2025-13467Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federationMaven · org.keycloak:keycloak-ldap-federation · fixed in 26.4.6, 26.2.11
- CVE-2025-65998Apache Syncope: Default AES key used for internal password encryptionMaven · org.apache.syncope:syncope-core · fixed in 4.0.3, 3.0.15
- CVE-2025-13435Dreampie Resty HttpClient HttpClient.java request path traversalMaven · cn.dreampie:resty
- CVE-2025-65089XWiki view file macro: User can view content of office file without view rights on the attachmentMaven · com.xwiki.pro:xwiki-pro-macros-ui · fixed in 1.27.0
- CVE-2025-64408Apache Causeway: Java deserialization vulnerability to authenticated attackersMaven · org.apache.causeway.commons:causeway-commons, org.apache.causeway.core:causeway-applib +3 · fixed in 3.5.0
- CVE-2025-54990XWiki AdminTools application doesn't set permissions on the AdminTools spaceMaven · com.xwiki.admintools:application-admintools · fixed in 1.1