Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-58369fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite sideMaven · co.fs2:fs2-io_0.26, co.fs2:fs2-io_0.27 +9 · fixed in 3.12.2, 3.13.0-M7, 2.5.13
- CVE-2025-10044Keycloak: keycloak error_description injection on error pagesMaven · org.keycloak:keycloak-account-ui, org.keycloak:keycloak-admin-ui · fixed in 26.2.9, 26.3.4
- CVE-2025-9467Possibility to bypass file upload validation on the server-sideMaven · com.vaadin:vaadin-server · fixed in 7.7.48, 8.28.2
- CVE-2025-43772Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions Maven · com.liferay:com.liferay.portal.workflow.kaleo.forms.web · fixed in 5.0.29
- CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attackMaven · io.netty:netty-codec, io.netty:netty-codec-compression · fixed in 4.1.125.Final, 4.2.5.Final
- CVE-2025-58056Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensionsMaven · io.netty:netty-codec-http · fixed in 4.1.125.Final, 4.2.5.Final
- CVE-2025-55748XWiki Platform's configuration files can be accessed through jsx and sx endpointsMaven · org.xwiki.platform:xwiki-platform-skin-skinx · fixed in 16.10.7
- CVE-2025-55747XWiki Platform's configuration files can be accessed through the webjars APIMaven · org.xwiki.platform:xwiki-platform-webjars, org.xwiki.platform:xwiki-platform-webjars-api · fixed in 16.10.7, 17.4.0-rc-1
- CVE-2025-58460A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission Maven · io.jenkins.plugins:opentelemetry · fixed in 3.1543.1545.vf5a
- CVE-2025-58459Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attaMaven · org.jenkins-ci.plugins:global-build-stats · fixed in 347.v32a
- CVE-2025-58458In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the Maven · org.jenkins-ci.plugins:git-client · fixed in 6.3.3
- CVE-2024-43166Incorrect Default Permissions vulnerability in Apache DolphinScheduler.Maven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.3.1
- CVE-2024-43115Apache DolphinScheduler: Alert Script AttackMaven · org.apache.dolphinscheduler:dolphinscheduler · fixed in 3.2.2
- CVE-2025-9784Undertow: undertow madeyoureset http/2 ddos vulnerabilityMaven · io.undertow:undertow-core · fixed in 2.2.38.Final, 2.3.20.Final
- CVE-2025-46047A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers toMaven · org.silverpeas.core:silverpeas-core · fixed in 6.4.3
- CVE-2025-3586In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2Maven · com.liferay:com.liferay.object.service · fixed in 1.0.96
- CVE-2025-43773Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thrMaven · com.liferay:com.liferay.portal.workflow.kaleo.runtime.impl · fixed in 6.0.93
- CVE-2025-55202Opencast has a partial path traversal vulnerability in UI configMaven · org.opencastproject:opencast-user-interface-configuration · fixed in 17.7, 18.1
- CVE-2025-58059Valtimo scripting engine can be used to gain access to sensitive data or resourcesMaven · com.ritense.valtimo:core · fixed in 12.16.0.RELEASE, 13.1.2.RELEASE
- CVE-2025-58049XWiki PDF export jobs store sensitive cookies unencrypted in job statusesMaven · org.xwiki.platform:xwiki-platform-export-pdf-api · fixed in 16.4.8, 16.10.7, 17.4.0-rc-1
- CVE-2025-26467Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)Maven · org.apache.cassandra:cassandra-all · fixed in 4.0.17
- CVE-2025-43764Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal Maven · com.liferay:com.liferay.portal.workflow.kaleo.designer.web · fixed in 5.0.145
- CVE-2025-43765A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024Maven · com.liferay:com.liferay.journal.service · fixed in 7.0.161
- CVE-2025-43766The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1Maven · com.liferay:com.liferay.style.book.web · fixed in 2.0.117
- CVE-2025-43767Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 202Maven · com.liferay:com.liferay.info.impl · fixed in 5.0.69
- CVE-2025-43768Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2Maven · com.liferay.portal:com.liferay.portal.impl · fixed in 108.1.1
- CVE-2025-43769Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024Maven · com.liferay:com.liferay.plugins.admin.web · fixed in 5.0.36
- CVE-2025-43770A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QMaven · com.liferay.portal:com.liferay.portal.kernel · fixed in 155.0.0
- CVE-2025-43761A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QMaven · com.liferay:com.liferay.frontend.editor.ckeditor.web, com.liferay:com.liferay.frontend.js.dependencies.web · fixed in 5.0.107, 1.0.25
- CVE-2025-43759Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 throMaven · com.liferay:com.liferay.layout.impl · fixed in 6.0.147