Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-32430XWiki Platform contains Reflected XSS vulnerability in two templatesMaven · org.xwiki.platform:xwiki-platform-web-templates · fixed in 16.4.8, 16.10.6, 17.3.0-rc-1
- CVE-2025-4604The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19,Maven · com.liferay:com.liferay.captcha.impl · fixed in 4.0.17
- CVE-2024-51775Apache Zeppelin: Command Injection via CSWSHMaven · org.apache.zeppelin:zeppelin-shell · fixed in 0.12.0
- CVE-2024-41177Apache Zeppelin: XSS in the Helium moduleMaven · org.apache.zeppelin:zeppelin-web · fixed in 0.12.0
- CVE-2024-52279Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection stringMaven · org.apache.zeppelin:zeppelin-jdbc · fixed in 0.12.0
- CVE-2025-24854Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginMaven · org.apache.jspwiki:jspwiki-main · fixed in 2.12.3
- CVE-2025-24853Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processingMaven · org.apache.jspwiki:jspwiki-main, org.apache.jspwiki:jspwiki-markdown · fixed in 2.12.3
- CVE-2025-54656Apache Struts Extras: Improper Output Neutralization for LogsMaven · org.apache.struts:struts-extras, struts:struts
- CVE-2025-54385XWiki Platform's searchDocuments API allows for SQL injectionMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.10.6, 17.3.0-rc-1
- CVE-2025-54380Opencast still publishes global system account credentialsMaven · org.opencastproject:opencast-common, org.opencastproject:opencast-ingest-service-impl +2 · fixed in 17.6
- CVE-2025-32429XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterMaven · org.xwiki.platform:xwiki-platform-distribution-war · fixed in 16.10.6, 17.3.0-rc-1
- CVE-2025-7962In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate Maven · com.sun.mail:jakarta.mail, org.eclipse.angus:smtp · fixed in 1.6.8, 2.0.2, 2.0.4
- CVE-2025-50151Apache Jena: Configuration files uploaded by administrative users are not check properlyMaven · org.apache.jena:jena · fixed in 5.5.0
- CVE-2025-49656Apache Jena: Administrative users can create files outside the server directory space via the admin UIMaven · org.apache.jena:jena-fuseki · fixed in 5.5.0
- CVE-2025-7789Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hashMaven · com.xuxueli:xxl-job-admin · fixed in 3.2.0
- CVE-2025-7787Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgeryMaven · com.xuxueli:xxl-job-core
- CVE-2025-7784Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)Maven · org.keycloak:keycloak-services · fixed in 26.2.6
- CVE-2024-9408In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.Maven · org.glassfish.main.admingui:console-common
- CVE-2024-10032In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-cluster-plugin
- CVE-2024-10031In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unMaven · org.glassfish.main.admingui:console-common
- CVE-2024-10029In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-cluster-plugin, org.glassfish.main.admingui:console-common
- CVE-2024-9343In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-common
- CVE-2024-9342In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faMaven · org.glassfish.main.admingui:console-common
- CVE-2025-22227CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP ClientMaven · io.projectreactor.netty:reactor-netty-http · fixed in 1.3.0-M5, 1.2.8
- CVE-2025-53622DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents fileMaven · org.dspace:dspace-api · fixed in 7.6.4, 8.2, 9.1
- CVE-2025-53621DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sourcesMaven · org.dspace:dspace-api · fixed in 7.6.4, 8.2, 9.1
- CVE-2025-48795Apache CXF: Denial of Service and sensitive data exposure in logsMaven · org.apache.cxf:cxf-core · fixed in 3.5.11, 3.6.6, 4.0.7 and more
- CVE-2025-53836XWiki Rendering is vulnerable to RCE attacks when processing nested macrosMaven · org.xwiki.rendering:xwiki-rendering-transformation-macro · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2025-53835XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntaxMaven · org.xwiki.rendering:xwiki-rendering-syntax-xhtml · fixed in 14.10
- CVE-2025-53689Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsMaven · org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-spi-commons · fixed in 2.23.2-beta, 2.20.17, 2.22.1