Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53836XWiki Rendering is vulnerable to RCE attacks when processing nested macrosMaven · org.xwiki.rendering:xwiki-rendering-transformation-macro · fixed in 13.10.11, 14.4.7, 14.10
- CVE-2025-53835XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntaxMaven · org.xwiki.rendering:xwiki-rendering-syntax-xhtml · fixed in 14.10
- CVE-2025-53689Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsMaven · org.apache.jackrabbit:jackrabbit-core, org.apache.jackrabbit:jackrabbit-spi-commons · fixed in 2.23.2-beta, 2.20.17, 2.22.1
- CVE-2024-41169Apache Zeppelin: raft directory listing and file readMaven · org.apache.zeppelin:zeppelin-interpreter, org.apache.zeppelin:zeppelin-server · fixed in 0.12.0
- CVE-2025-30402A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execMaven · org.pytorch:executorch-android · fixed in 0.7.0-rc1
- CVE-2025-48924Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputsMaven · commons-lang:commons-lang, org.apache.commons:commons-lang3 · fixed in 3.18.0
- CVE-2025-53864Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeplMaven · com.nimbusds:nimbus-jose-jwt · fixed in 10.0.2, 9.37.4
- CVE-2025-53506Apache Tomcat: DoS via excessive h2 streams at connection startMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.107, 10.1.43, 11.0.9
- CVE-2025-52520Apache Tomcat: DoS via integer overflow in multipart file uploadMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.9, 10.1.43, 9.0.107
- CVE-2025-52434Apache Tomcat: APR/Native Connector crash leading to DoSMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.107
- CVE-2025-7365Keycloak: phishing attack via email verification step in first login flowMaven · org.keycloak:keycloak-services · fixed in 26.0.13, 26.2.6
- CVE-2025-53743Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the Maven · org.jenkins-ci.plugins:applitools-eyes
- CVE-2025-53742Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, Maven · org.jenkins-ci.plugins:applitools-eyes
- CVE-2025-53678Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins contMaven · io.jenkins.plugins:user1st-utester
- CVE-2025-53677Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential forMaven · io.jenkins.plugins:xooa
- CVE-2025-53676Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controlleMaven · io.jenkins.plugins:xooa
- CVE-2025-53675Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they Maven · org.jenkins-ci.plugins:warrior
- CVE-2025-53674Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, inMaven · org.jenkins-ci.plugins:sensedia-api-platform
- CVE-2025-53673Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration filMaven · org.jenkins-ci.plugins:sensedia-api-platform
- CVE-2025-53672Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controllMaven · io.jenkins.plugins:kryptowire
- CVE-2025-53671Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job confMaven · org.jenkins-ci.plugins:nouvola-divecloud
- CVE-2025-53670Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fiMaven · org.jenkins-ci.plugins:nouvola-divecloud
- CVE-2025-53669Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential fMaven · org.jenkins-ci.plugins:vaddy-plugin
- CVE-2025-53668Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they Maven · org.jenkins-ci.plugins:vaddy-plugin
- CVE-2025-53667Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potentiaMaven · org.jenkins-ci.plugins:deadmanssnitch
- CVE-2025-53666Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where thMaven · org.jenkins-ci.plugins:deadmanssnitch
- CVE-2025-53665Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration forMaven · com.apica:apicaloadtest
- CVE-2025-53664Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the JeMaven · com.apica:apicaloadtest
- CVE-2025-53663Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the JenkinsMaven · com.ibm.devops:ibm-cloud-devops
- CVE-2025-53662Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins contrMaven · org.jenkins-ci.plugins:ifttt-build-notifier