Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-62239Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0Maven · com.liferay:com.liferay.portal.workflow.kaleo.designer.web · fixed in 5.0.124
- CVE-2025-37727Elasticsearch Insertion of sensitive information in log fileMaven · org.elasticsearch.plugin:reindex-client · fixed in 8.18.8, 8.19.5, 9.0.8 and more
- CVE-2025-30001Apache StreamPark: Authenticated users can trigger remote command executionMaven · org.apache.streampark:streampark
- CVE-2025-62240Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Maven · com.liferay:com.liferay.calendar.web · fixed in 5.0.88
- CVE-2025-62228Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiersMaven · org.apache.flink:flink-cdc-pipeline-connectors, org.apache.flink:flink-connector-db2-cdc +3 · fixed in 3.5.0
- CVE-2025-61788Opencast Paella Player 7 vulnerable to Cross-Site-ScriptingMaven · org.opencastproject:opencast-common
- CVE-2025-43771Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DMaven · com.liferay:com.liferay.flags.web · fixed in 6.0.24
- CVE-2025-43829Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and LiferMaven · com.liferay.commerce:com.liferay.commerce.shop.by.diagram.web · fixed in 1.0.83
- CVE-2025-43830Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.QMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-43821Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and LifeMaven · com.liferay.commerce:com.liferay.commerce.product.service · fixed in 6.0.134
- CVE-2025-43822Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-43823Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 202Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-43824The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-52472XWiki Platform vulnerable to HQL injection via wiki and space search REST APIMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 17.4.2, 16.10.9
- CVE-2025-49594XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` rightMaven · org.xwiki.contrib.oidc:oidc-authenticator · fixed in 2.18.2
- CVE-2025-43825A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3Maven · com.liferay:com.liferay.portal.template.freemarker · fixed in 7.0.60
- CVE-2025-61735Apache Kylin: Server-Side Request ForgeryMaven · org.apache.kylin:kylin, org.apache.kylin:kylin-common-server +5 · fixed in 5.0.3
- CVE-2025-61733Apache Kylin: Authentication bypassMaven · org.apache.kylin:kylin, org.apache.kylin:kylin-core-common · fixed in 5.0.3
- CVE-2025-61734Apache Kylin: improper restriction of file readMaven · org.apache.kylin:kylin, org.apache.kylin:kylin-common-server +5 · fixed in 5.0.3
- CVE-2025-11226Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and JaninoMaven · ch.qos.logback:logback-core · fixed in 1.5.19, 1.3.16
- CVE-2025-43826Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupporteMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.113-ga113
- CVE-2025-43827Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported verMaven · com.liferay:com.liferay.portal.security.audit.storage.service, com.liferay:com.liferay.portal.security.audit.web · fixed in 6.0.41, 5.0.33
- CVE-2025-59952minio-java Client XML Tag is Vulnerable to Value SubstitutionMaven · io.minio:minio · fixed in 8.6.0
- CVE-2025-43817Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 througMaven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.112-ga112
- CVE-2025-43813Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsuppoMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.portal.bom · fixed in 96.0.0, 7.4.3.108-ga108
- CVE-2025-43812Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throMaven · com.liferay.portal:release.portal.bom, com.liferay:com.liferay.journal.web · fixed in 7.4.3.112-ga112, 5.0.161
- CVE-2025-43811Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and LifMaven · com.liferay:com.liferay.item.selector.web · fixed in 7.0.52
- CVE-2025-43820Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 throughMaven · com.liferay.portal:release.portal.bom, com.liferay:com.liferay.calendar.web · fixed in 7.4.3.111-ga111, 5.0.88
- CVE-2025-43818Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 throMaven · com.liferay:com.liferay.calendar.web · fixed in 5.0.87
- CVE-2025-43815Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and LiferayMaven · com.liferay:com.liferay.product.navigation.control.menu.web · fixed in 6.0.83