Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-12383Race Condition allows Bypass of Trust RestrictionsMaven · org.glassfish.jersey.core:jersey-client · fixed in 2.46, 3.0.17, 3.1.10
- CVE-2025-13266wwwlike vlife VLifeApi SysFileApi.java create path traversalMaven · io.github.wwwlike:vlife-base
- CVE-2025-13265lsfusion platform ZipUtils.java unpackFile path traversalMaven · lsfusion.platform:server
- CVE-2025-13262lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversalMaven · lsfusion.platform:web-client
- CVE-2025-13261lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversalMaven · lsfusion.platform:web-client
- CVE-2025-11538Keycloak-server: debug default bind addressMaven · org.keycloak:keycloak-quarkus-dist · fixed in 26.4.4
- CVE-2025-64099OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_infoMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.0.3
- CVE-2025-64518CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injectionMaven · org.cyclonedx:cyclonedx-core-java · fixed in 11.0.1
- CVE-2025-10713XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationMaven · org.wso2.carbon.mediation:org.wso2.carbon.localentry
- CVE-2025-62275Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 thrMaven · com.liferay:com.liferay.blogs.item.selector.web · fixed in 6.0.19
- CVE-2025-62276The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay:com.liferay.adaptive.media.web · fixed in 69.1.0, 5.0.52
- CVE-2025-62267Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3Maven · com.liferay:com.liferay.dynamic.data.mapping.item.selector.web · fixed in 1.0.9
- CVE-2025-62264Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.QMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-62265Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-62266By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 tMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.110
- CVE-2025-62257Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 throMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.120
- CVE-2025-64150A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect tMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64149A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an aMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64148A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerateMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64147Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackeMaven · org.jenkins-ci.plugins:curseforge-publisher
- CVE-2025-64146Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewMaven · org.jenkins-ci.plugins:curseforge-publisher
- CVE-2025-64145Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for atMaven · io.jenkins.plugins:byteguard-build-actions
- CVE-2025-64144Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can beMaven · io.jenkins.plugins:byteguard-build-actions
- CVE-2025-64143Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controllMaven · com.openshift.jenkins:openshift-pipeline
- CVE-2025-64142A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect toMaven · org.jenkins-ci.plugins:nexus-task-runner
- CVE-2025-64141A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an atMaven · org.jenkins-ci.plugins:nexus-task-runner
- CVE-2025-64140Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with IteMaven · org.jenkins-ci.plugins:azure-cli
- CVE-2025-64139A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connMaven · org.jenkins-ci.plugins:windocks-start-container
- CVE-2025-64138A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect toMaven · org.jenkins-ci.plugins:windocks-start-container
- CVE-2025-64137A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:themis