Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-1396Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt
- CVE-2025-43816A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and LifeMaven · com.liferay:com.liferay.portal.vulcan.impl · fixed in 5.0.115
- CVE-2025-56769An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary methMaven · cn.hutool:hutool-extra · fixed in 5.8.40
- CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore CommandsMaven · org.apache.zookeeper:zookeeper · fixed in 3.9.4
- CVE-2025-48392Apache IoTDB: DoS VulnerabilityMaven · org.apache.iotdb:iotdb-core · fixed in 2.0.5
- CVE-2025-48459Apache IoTDB: Deserialization of untrusted DataMaven · org.apache.iotdb:iotdb-confignode · fixed in 2.0.5
- CVE-2025-43819A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4Maven · com.liferay:com.liferay.saml.impl · fixed in 5.0.51
- CVE-2025-59822Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sectionMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.31, 1.0.0-M45
- CVE-2024-6429Content Spoofing in Multiple WSO2 Products via Error Message InjectionMaven · org.wso2.identity.apps:authentication-portal · fixed in 2.4.4
- CVE-2025-4760Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherMaven · org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 · fixed in 9.31.117
- CVE-2025-43814In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 20Maven · com.liferay:com.liferay.portal.security.audit.event.generators.user.management · fixed in 5.0.13
- CVE-2025-43810Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2Maven · com.liferay.commerce:com.liferay.commerce.service · fixed in 11.0.164
- CVE-2025-43806Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GMaven · com.liferay:com.liferay.batch.engine.service, com.liferay:com.liferay.headless.batch.engine.impl · fixed in 4.0.102, 4.0.52
- CVE-2025-59432Timing Attack Vulnerability in SCRAM AuthenticationMaven · com.ongres.scram:scram-common · fixed in 3.2
- CVE-2025-43807Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Maven · com.liferay:com.liferay.change.tracking.service · fixed in 3.0.91
- CVE-2025-6544Deserialization Vulnerability in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2025-43808The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10,Maven · com.liferay.commerce:com.liferay.commerce.product.type.virtual.service · fixed in 4.0.47
- CVE-2025-43809Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and oldMaven · com.liferay.portal:com.liferay.portal.impl · fixed in 101.0.0
- CVE-2025-43803Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsMaven · com.liferay:com.liferay.contacts.web · fixed in 5.0.59
- CVE-2025-59340jinjava Sandbox Bypass via JavaType-Based DeserializationMaven · com.hubspot.jinjava:jinjava · fixed in 2.8.1, 2.7.5
- CVE-2025-59476Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified coMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.516.3, 2.528
- CVE-2025-59475Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.516.3, 2.528
- CVE-2025-59474Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.516.3, 2.528
- CVE-2025-43804Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1Maven · com.liferay:com.liferay.portal.search · fixed in 8.0.93
- CVE-2025-43805Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA throughMaven · com.liferay:com.liferay.asset.display.page.service · fixed in 4.0.55
- CVE-2025-10492Jaspersoft Library Deserialisation VulnerabilityMaven · net.sf.jasperreports:jasperreports · fixed in 7.0.4
- CVE-2025-43801Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LMaven · com.liferay.portal:com.liferay.portal.impl · fixed in 101.0.0
- CVE-2025-41243Spring Expression Language property modification using Spring Cloud Gateway Server WebFluxMaven · org.springframework.cloud:spring-cloud-gateway-server-webflux · fixed in 4.2.5, 4.3.1
- CVE-2025-41249CVE-2025-41249: Spring Framework Annotation Detection VulnerabilityMaven · org.springframework:spring-core · fixed in 6.2.11
- CVE-2025-41248CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesMaven · org.springframework.security:spring-security-core · fixed in 6.4.10, 6.5.4