Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-64136A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specMaven · org.jenkins-ci.plugins:themis
- CVE-2025-64135Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` Maven · io.jenkins.plugins:eggplant-runner
- CVE-2025-64134Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevMaven · org.jenkins-ci.plugins:jdepend
- CVE-2025-64133A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackeMaven · jp.ikedam.jenkins.plugins:extensible-choice-parameter
- CVE-2025-64132Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trMaven · io.jenkins.plugins:mcp-server · fixed in 0.86.v7d3355e6a
- CVE-2025-64131Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about Maven · org.jenkins-ci.plugins:saml · fixed in 4.583.585.v22ccc1139f55
- CVE-2025-12390Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session idMaven · org.keycloak:keycloak-services · fixed in 26.0.0
- CVE-2025-10939Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin consoleMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.4.4
- CVE-2025-62258CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through upMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.108
- CVE-2025-62259Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 9Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.110
- CVE-2025-62260Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.100
- CVE-2025-62261Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92Maven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.portal.bom · fixed in 92.0.2, 7.4.3.100
- CVE-2025-62784InventoryGui allows item duplication in GUIs which use GuiStorageElementMaven · de.themoep:inventorygui · fixed in 1.6.5
- CVE-2025-62783InventoryGui affected by item duplication in GUIs which use GuiStorageElementMaven · de.themoep:inventorygui · fixed in 1.6.2-SNAPSHOT
- CVE-2025-62782InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElementMaven · de.themoep:inventorygui · fixed in 1.6.4-SNAPSHOT
- CVE-2025-62262Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported vMaven · com.liferay:com.liferay.portal.security.ldap.impl · fixed in 4.0.54
- CVE-2025-62263Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, Maven · com.liferay:com.liferay.account.admin.web · fixed in 2.0.108
- CVE-2025-62253Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXPMaven · com.liferay:com.liferay.layout.admin.web · fixed in 5.0.157
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.12, 10.1.47, 9.0.110
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.11, 10.1.45, 9.0.109
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messagesMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.11, 10.1.45, 9.0.109
- CVE-2025-12194Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc.Maven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-debug-lts8on · fixed in 2.1.2, 2.73.8
- CVE-2025-62254The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 202Maven · com.liferay.portal:com.liferay.portal.impl · fixed in 97.0.0
- CVE-2025-62255Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older uMaven · com.liferay:com.liferay.knowledge.base.web · fixed in 5.0.109
- CVE-2025-12110Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedMaven · org.keycloak:keycloak-services · fixed in 26.2.3
- CVE-2025-11429Keycloak-server: too long and not settings compliant sessionMaven · org.keycloak:keycloak-services · fixed in 26.4.1, 26.2.11
- CVE-2025-62256Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, Maven · com.liferay:com.liferay.portal.security.auth.verifier · fixed in 6.0.26
- CVE-2025-60837A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a useMaven · net.mingsoft:ms-mcms
- CVE-2025-62710Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImplMaven · org.sakaiproject.kernel:sakai-kernel-impl
- CVE-2025-62247Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025Maven · com.liferay:com.liferay.search.experiences.service