Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-43738A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QMaven · com.liferay:com.liferay.expando.web
- CVE-2025-43739Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay:com.liferay.calendar.service · fixed in 6.0.83
- CVE-2025-43740A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43731A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-3639Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43732Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3Maven · com.liferay:com.liferay.roles.selector.web · fixed in 5.0.32
- CVE-2025-43733A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a rMaven · com.liferay:com.liferay.layout.taglib · fixed in 17.0.0
- CVE-2025-41242CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containersMaven · org.springframework:spring-webmvc · fixed in 6.2.10
- CVE-2025-9092Hybrid Module Deployment in Multi-JVM Environments Leading to Resource ExhaustionMaven · org.bouncycastle:bc-fips · fixed in 2.1.1
- CVE-2025-55163Netty MadeYouReset HTTP/2 DDoS VulnerabilityMaven · io.grpc:grpc-netty-shaded, io.netty:netty-codec-http2 · fixed in 1.75.0, 4.2.4.Final, 4.1.124.Final
- CVE-2025-55668Apache Tomcat: session fixation via rewrite valveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.8, 10.1.42, 9.0.106
- CVE-2025-48989Apache Tomcat: h2 DoS - Made You ResetMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 11.0.10, 10.1.44, 9.0.108
- CVE-2025-8916Possible DOS in processing large name constraint structures in PKIXCertPathReveiwerMaven · org.bouncycastle:bcpkix-fips, org.bouncycastle:bcpkix-jdk15on +2 · fixed in 1.0.8, 2.0.8, 1.79
- CVE-2025-43734A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +1 · fixed in 2024.q1.17, 2025.q1.11, 15.2.2
- CVE-2025-43735A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QMaven · com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom +1 · fixed in 109.1.0, 2024.q1.13, 7.4.3.132
- CVE-2025-43736A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom +4 · fixed in 2025.Q1.9, 2024.Q1.17, 2.0.138 and more
- CVE-2025-8885Possible DOS in processing specially formed ASN.1 Object IdentifiersMaven · org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk14 +5 · fixed in 1.0.2.6, 2.0.1, 1.78
- CVE-2025-4655SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2025.Q1.6, 2024.Q1.16
- CVE-2025-4581Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2025.Q1.5, 2024.Q1.16
- CVE-2025-4576A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay:com.liferay.blogs.web · fixed in 6.0.139
- CVE-2025-53606Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerMaven · org.apache.seata:seata-serializer-fury · fixed in 2.5.0
- CVE-2025-48913Apache CXF: Untrusted JMS configuration can lead to RCEMaven · org.apache.cxf:cxf-rt-transports-jms · fixed in 3.6.8, 4.0.9, 4.1.3
- CVE-2025-54951A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially resultMaven · org.pytorch:executorch-android · fixed in 0.7.0
- CVE-2025-54950An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execMaven · org.pytorch:executorch-android · fixed in 0.7.0
- CVE-2025-54949A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effecMaven · org.pytorch:executorch-android · fixed in 0.7.0
- CVE-2025-30405An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, poMaven · org.pytorch:executorch-android · fixed in 0.7.0
- CVE-2025-30404An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execuMaven · org.pytorch:executorch-android · fixed in 0.7.0
- CVE-2025-8419Org.keycloak/keycloak-services: keycloak smtp inject vulnerabilityMaven · org.keycloak:keycloak-services · fixed in 26.2.8, 26.3.3
- CVE-2025-54125XWiki Platform: Password and email exposure in xml.vm fieldsMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.4.7, 16.10.5, 17.2.0-rc-1
- CVE-2025-54124XWiki Platform: Any user with editing rights can access password properties through Database List PropertiesMaven · org.xwiki.platform:xwiki-platform-legacy-oldcore, org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.4.7, 16.10.5, 17.2.0-rc-1