Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-85254Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name CasingMaven · org.apache.camel:camel-platform-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85251Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect TargetsMaven · org.apache.camel:camel-http · fixed in 4.18.5, 4.22.1
- CVE-2026-85250Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionMaven · org.apache.camel:camel-xpath · fixed in 4.18.5, 4.22.1
- CVE-2026-85249Apache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataMaven · org.apache.camel:camel-tika · fixed in 4.18.5, 4.22.1
- CVE-2026-85247Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a TruststoreMaven · org.apache.camel:camel-knative · fixed in 4.18.5, 4.22.1
- CVE-2026-85246Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-mina · fixed in 4.18.5, 4.22.1
- CVE-2026-85245Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetMaven · org.apache.camel:camel-thrift · fixed in 4.18.5, 4.22.1
- CVE-2026-85243Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureMaven · org.apache.camel:camel-crypto-pgp · fixed in 4.18.5, 4.22.1
- CVE-2026-84181Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject ReuseMaven · org.apache.camel:camel-shiro · fixed in 4.18.5, 4.22.1
- CVE-2026-84180Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer ExceptionsMaven · org.apache.camel:camel-knative · fixed in 4.18.5, 4.22.1
- CVE-2026-84176Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionMaven · org.apache.camel:camel-platform-http-vertx · fixed in 4.18.5, 4.22.1
- CVE-2026-80344Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery AddressMaven · org.apache.camel:camel-as2 · fixed in 4.18.5, 4.22.1
- CVE-2026-80343Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingMaven · org.apache.camel:camel-netty-http · fixed in 4.18.5, 4.22.1
- CVE-2026-79986Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without…Maven · org.apache.camel:camel-azure-files · fixed in 4.18.5, 4.22.1
- CVE-2026-79983Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without…Maven · org.apache.camel:camel-ftp · fixed in 4.18.5, 4.22.1
- CVE-2026-78162Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)Maven · org.apache.camel:camel-hazelcast · fixed in 4.18.5, 4.22.1
- CVE-2026-102834JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSMaven · org.bytedeco:javacv · fixed in 1.5.14
- CVE-2026-97370Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extractionMaven · com.github.junrar:junrar · fixed in 7.6.1
- CVE-2026-55414NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)Maven · nl.nl-portal:form · fixed in 3.0.4
- CVE-2026-54683NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)Maven · nl.nl-portal:documenten-api · fixed in 3.0.3
- CVE-2026-102695OmniFaces: Forged combined-resource IDs and related output/push boundariesMaven · org.omnifaces:omnifaces · fixed in 1.14.3, 2.7.33, 3.14.23 and more
- CVE-2026-54641OpenRemote: Cross-Realm User Information Disclosure in UserResourceImplMaven · io.openremote:openremote-manager · fixed in 1.24.2
- CVE-2026-54640OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryMaven · io.openremote:openremote-agent · fixed in 1.24.2
- CVE-2026-54697ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsingMaven · org.connectbot.sshlib:sshlib
- CVE-2026-54700ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocationMaven · org.connectbot.sshlib:sshlib
- CVE-2026-107226AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSMaven · org.asynchttpclient:async-http-client · fixed in 3.0.14
- CVE-2026-102554Denial of Service via Eager Array Allocation During Deserialization in GuavaMaven · com.google.guava:guava · fixed in 33.7.2
- CVE-2026-108106Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of ServiceMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.9
- CVE-2026-107726Hazelcast: Arbitrary member memory access by low-privileged clientMaven · com.hazelcast:hazelcast · fixed in 5.7.0
- CVE-2026-107725Hazelcast: Authorization bypass in IMap Predicates APIMaven · com.hazelcast:hazelcast · fixed in 5.7.0