Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-43762Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay:com.liferay.dynamic.data.mapping.form.field.type, com.liferay:com.liferay.dynamic.data.mapping.form.web · fixed in 6.0.187, 4.0.180
- CVE-2025-43758Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay:com.liferay.frontend.js.web, com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type +1 · fixed in 5.0.125, 1.0.65, 1.0.219
- CVE-2025-43760A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-43751User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 202Maven · com.liferay:com.liferay.login.web · fixed in 6.0.66
- CVE-2025-9340native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.Maven · org.bouncycastle:bc-fips · fixed in 2.1.1
- CVE-2025-9341Garbage collection can delay for AES CBC Native support, resulting in heap exhaustionMaven · org.bouncycastle:bc-fips, org.bouncycastle:bctls-fips · fixed in 2.1.1, 2.73.8
- CVE-2025-43752Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-51825JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSMaven · org.jeecgframework.boot:jeecg-boot-base-core · fixed in 3.8.1
- CVE-2025-43753A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 202Maven · com.liferay:com.liferay.layout.taglib · fixed in 16.1.32
- CVE-2025-43754Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughMaven · com.liferay.portal:release.portal.bom
- CVE-2025-43755A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 20Maven · com.liferay:com.liferay.layout.admin.web · fixed in 5.0.191
- CVE-2025-43756<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Maven · com.liferay.portal:release.portal.bom
- CVE-2025-9162Org.keycloak/keycloak-model-storage-service: variable injection into environment variablesMaven · org.keycloak:keycloak-model-storage-services · fixed in 26.3.4
- CVE-2025-51606hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.Maven · cn.hippo4j:hippo4j-core
- CVE-2025-9264Xuxueli xxl-job Jobs JobInfoController.java remove resource injectionMaven · com.xuxueli:xxl-job-admin · fixed in 3.2.0
- CVE-2025-9263Xuxueli xxl-job JobLogController.java getJobsByGroup resource injectionMaven · com.xuxueli:xxl-job-admin · fixed in 3.2.0
- CVE-2025-54988Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFAMaven · org.apache.tika:tika-parser-pdf-module, org.apache.tika:tika-parsers · fixed in 3.2.2, 2.0.0-ALPHA
- CVE-2025-43757A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-5115MadeYouReset HTTP/2 vulnerabilityMaven · org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:jetty-http2-common · fixed in 9.4.58, 10.0.26, 11.0.26 and more
- CVE-2025-43746A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QMaven · ccom.liferay:com.liferay.dynamic.data.mapping.web, com.liferay.portal:release.portal.bom · fixed in 5.0.122
- CVE-2025-43748Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Maven · com.liferay.portal:release.portal.bom · fixed in 7.4.3.120-ga120
- CVE-2025-43749Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43750Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay:com.liferay.dynamic.data.mapping.form.web · fixed in 4.0.180
- CVE-2025-43741A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-43742A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay:com.liferay.layout.type.controller.display.page · fixed in 3.0.59
- CVE-2024-39954Apache EventMesh Runtime: SSRFMaven · org.apache.eventmesh:eventmesh-runtime
- CVE-2025-43744A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 202Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43743Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43745A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43737A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.QMaven · com.liferay:com.liferay.journal.web · fixed in 5.0.196