Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53662Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins contrMaven · org.jenkins-ci.plugins:ifttt-build-notifier
- CVE-2025-53661Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing Maven · io.jenkins.plugins:testsigma
- CVE-2025-53660Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, incMaven · org.jenkins-ci.plugins:qmetry-test-management
- CVE-2025-53659Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins Maven · org.jenkins-ci.plugins:qmetry-test-management
- CVE-2025-53658Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scrMaven · org.jenkins-ci.plugins:applitools-eyes · fixed in 1.16.6
- CVE-2025-53657Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed oMaven · org.jenkins-ci.plugins:soapui-pro-functional-testing
- CVE-2025-53656Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in jobMaven · org.jenkins-ci.plugins:soapui-pro-functional-testing
- CVE-2025-53655Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenMaven · org.jenkins.plugins.statistics.gatherer:statistics-gatherer
- CVE-2025-53654Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins cMaven · org.jenkins.plugins.statistics.gatherer:statistics-gatherer
- CVE-2025-53653Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the JenkinsMaven · org.jenkins-ci.plugins:aqua-security-scanner
- CVE-2025-53652Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches oMaven · org.jenkins-ci.tools:git-parameter · fixed in 444.vca
- CVE-2025-53651Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTMMaven · org.jenkins-ci.plugins:htmlpublisher · fixed in 427
- CVE-2025-53650Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present Maven · org.jenkins-ci.plugins:credentials-binding · fixed in 687.689.v1a
- CVE-2025-53602Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.Maven · io.zipkin:zipkin-server
- CVE-2025-53106Graylog vulnerable to privilege escalation through API tokensMaven · org.graylog2:graylog2-server · fixed in 6.2.4, 6.3.0-rc.2
- CVE-2025-53103JUnit OpenTestReportGeneratingListener can leak Git credentialsMaven · org.junit.platform:junit-platform-reporting · fixed in 5.13.2
- CVE-2025-53003Janssen Config API returns results without scope verificationMaven · io.jans:jans-config-api-server · fixed in 1.8.0
- CVE-2025-26074Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.Maven · org.conductoross:conductor-core · fixed in 3.21.13
- CVE-2025-32897Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerMaven · org.apache.seata:seata-config-core · fixed in 2.3.0
- CVE-2025-53393In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.Maven · com.typesafe.akka:akka-cluster-metrics_2.13, com.typesafe.akka:akka-cluster-metrics_3
- CVE-2025-5731Infinispan: credential leakage in infinispan cliMaven · org.infinispan:infinispan-cli-client
- CVE-2025-6701Xuxueli xxl-sso doLogin redirectMaven · com.xuxueli:xxl-sso
- CVE-2025-6700Xuxueli xxl-sso login cross site scriptingMaven · com.xuxueli:xxl-sso
- CVE-2025-52999jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested dataMaven · com.fasterxml.jackson.core:jackson-core · fixed in 2.15.0
- CVE-2025-52888Allure 2's xunit-xml-plugin Vulnerable to Improper XXE RestrictionMaven · io.qameta.allure.plugins:junit-xml-plugin, io.qameta.allure.plugins:trx-plugin +1 · fixed in 2.34.1
- CVE-2025-49574Quarkus potential data leak when duplicating a duplicated contextMaven · io.quarkus:quarkus-vertx · fixed in 3.15.6, 3.20.2, 3.24.1
- CVE-2025-48059PowSyBl Core Contains a Polynomial ReDoS in RegexCriterionMaven · com.powsybl:powsybl-contingency-api, com.powsybl:powsybl-iidm-criteria · fixed in 6.3.0, 6.7.2
- CVE-2025-48058PowSyBl Core contains Polynomial REDoS’esMaven · com.powsybl:powsybl-commons · fixed in 6.7.2
- CVE-2025-47771PowSyBl Core allows deserialization of untrusted SparseMatrix dataMaven · com.powsybl:powsybl-math · fixed in 6.7.2
- CVE-2025-47293PowSyBl Core XML Reader allows XXE and SSRFMaven · com.powsybl:powsybl-commons · fixed in 6.7.2