Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-62248A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.Maven · com.liferay:com.liferay.dynamic.data.mapping.web
- CVE-2025-11965In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails toMaven · io.vertx:vertx-web · fixed in 4.5.22, 5.0.5
- CVE-2025-11966In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted inMaven · io.vertx:vertx-web · fixed in 4.5.22, 5.0.5
- CVE-2025-62249A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.QMaven · com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62250Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 throMaven · com.liferay:com.liferay.portal.cluster.multiple · fixed in 5.0.35
- CVE-2025-57738Apache Syncope: Remote Code Execution by delegated administratorsMaven · org.apache.syncope.core:syncope-core-spring · fixed in 3.0.14, 4.0.2
- CVE-2025-47410Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target systemMaven · org.apache.geode:geode-web · fixed in 1.15.2
- CVE-2025-34281Stored Cross-Site Scripting (XSS) in ThingsBoardMaven · org.thingsboard:application · fixed in 4.2.1
- CVE-2025-11849Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of thMaven · org.zwobble.mammoth:mammoth · fixed in 1.11.0
- CVE-2024-31573XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transMaven · org.xmlunit:xmlunit-core · fixed in 2.10.0
- CVE-2025-56316A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execMaven · net.mingsoft:ms-mcms · fixed in 6.0.2
- CVE-2025-41254Spring Framework STOMP CSRF VulnerabilityMaven · org.springframework:spring-websocket · fixed in 6.2.12
- CVE-2025-41253Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment VariablesMaven · org.springframework.cloud:spring-cloud-gateway-server · fixed in 4.3.2, 4.2.6
- CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by defaultMaven · org.opensearch.dataprepper.plugins:opensearch · fixed in 2.12.2
- CVE-2025-59419Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email ForgeryMaven · io.netty:netty-codec-smtp · fixed in 4.2.7.Final, 4.1.128.Final
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksMaven · org.apache.spark:spark-network-common_2.12, org.apache.spark:spark-network-common_2.13 · fixed in 3.4.4, 3.5.2
- CVE-2025-59250JDBC Driver for SQL Server Spoofing VulnerabilityMaven · com.microsoft.sqlserver:mssql-jdbc · fixed in 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11 and more
- CVE-2024-44088Apache Geode: Reflected XSSMaven · org.apache.geode:geode-web-api · fixed in 1.15.2
- CVE-2025-62251Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 aMaven · com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary · fixed in 1.0.23
- CVE-2025-62252Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LiferayMaven · com.liferay.portal:com.liferay.portal.impl · fixed in 99.0.0
- CVE-2025-62246Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LiMaven · com.liferay:com.liferay.mentions.web · fixed in 6.0.35
- CVE-2025-62241Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote autheMaven · com.liferay.commerce:com.liferay.commerce.order.content.web · fixed in 4.0.114
- CVE-2025-62242Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 20Maven · com.liferay:com.liferay.change.tracking.web · fixed in 2.0.120
- CVE-2025-62243Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 tMaven · com.liferay:com.liferay.change.tracking.web · fixed in 2.0.122
- CVE-2025-62244Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 tMaven · com.liferay:com.liferay.change.tracking.web · fixed in 2.0.122
- CVE-2025-62245Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023Maven · com.liferay:com.liferay.change.tracking.web · fixed in 2.0.121
- CVE-2025-11581PowerJob OpenAPIController runJob authorizationMaven · tech.powerjob:powerjob-server-starter
- CVE-2025-11580PowerJob list authorizationMaven · tech.powerjob:powerjob
- CVE-2025-62237Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2Maven · com.liferay.commerce:com.liferay.commerce.order.web · fixed in 5.0.101
- CVE-2025-62238Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, andMaven · com.liferay:com.liferay.account.admin.web · fixed in 2.0.114