Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-48058PowSyBl Core contains Polynomial REDoS’esMaven · com.powsybl:powsybl-commons · fixed in 6.7.2
- CVE-2025-47771PowSyBl Core allows deserialization of untrusted SparseMatrix dataMaven · com.powsybl:powsybl-math · fixed in 6.7.2
- CVE-2025-47293PowSyBl Core XML Reader allows XXE and SSRFMaven · com.powsybl:powsybl-commons · fixed in 6.7.2
- CVE-2025-6384Improper Control of Dynamically-Managed Code Resources in Crafter StudioMaven · org.craftercms:crafter-studio · fixed in 4.3.0
- CVE-2025-32896Apache SeaTunnel: Unauthenticated insecure accessMaven · org.apache.seatunnel:seatunnel-engine-common, org.apache.seatunnel:seatunnel-engine-server · fixed in 2.3.11
- CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersMaven · commons-fileupload:commons-fileupload, org.apache.commons:commons-fileupload2-core · fixed in 1.6.0, 2.0.0-M4
- CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat +1 · fixed in 11.0.8, 10.1.42, 9.0.106
- CVE-2025-3526SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppoMaven · com.liferay.portal:com.liferay.portal.kernel · fixed in 38.0.0
- CVE-2025-49125Apache Tomcat: Security constraint bypass for pre/post-resourcesMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.8, 10.1.42, 9.0.106
- CVE-2025-3594Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GMaven · com.liferay:com.liferay.server.admin.web · fixed in 5.0.24, 4.0.48, 3.0.67 and more
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoSMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.8, 10.1.42, 9.0.106
- CVE-2025-3602Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and Maven · com.liferay:com.liferay.portal.vulcan.impl · fixed in 5.0.103
- CVE-2025-49587XWiki does not require right warnings for notification displayer objectsMaven · org.xwiki.platform:xwiki-platform-notifications-notifiers-default · fixed in 15.10.16, 16.4.7, 16.10.2
- CVE-2025-49586XWiki allows remote code execution through preview of XClass changes in AWM editorMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 16.4.7, 16.10.3, 17.0.0
- CVE-2025-49585XWiki does not require right warnings for XClass definitionsMaven · org.xwiki.platform:xwiki-platform-security-requiredrights-default · fixed in 15.10.16, 16.4.7, 16.10.2
- CVE-2025-49584XWiki makes title of inaccessible pages available through the class property values REST APIMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 16.4.7, 16.10.3, 17.0.0
- CVE-2025-49583XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin rightMaven · org.xwiki.platform:xwiki-platform-notifications-notifiers-default · fixed in 15.10.16, 16.4.7, 16.10.2
- CVE-2025-49582XWiki's required right warnings for macros are incompleteMaven · org.xwiki.platform:xwiki-platform-rendering-macro-cache, org.xwiki.platform:xwiki-platform-rendering-macro-context +2 · fixed in 16.4.7, 16.10.3, 17.0.0
- CVE-2025-49581XWiki allows remote code execution through default value of wiki macro wiki-type parametersMaven · org.xwiki.platform:xwiki-platform-rendering-wikimacro-store · fixed in 16.4.7, 16.10.3, 17.0.0
- CVE-2025-49580XWiki allows privilege escalation through link refactoringMaven · org.xwiki.platform:xwiki-platform-refactoring-default · fixed in 17.1.0-rc-1, 16.10.4, 16.4.7
- CVE-2025-46096Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy componentMaven · org.noear:solon-faas-luffy · fixed in 3.2.0
- CVE-2025-41234RFD Attack via “Content-Disposition” Header Sourced from RequestMaven · org.springframework:spring-web · fixed in 6.2.8, 6.1.21
- CVE-2024-56158XWiki allows SQL injection in query endpoint of REST API with OracleMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 15.10.16, 16.4.7, 16.10.2
- CVE-2025-49146pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require ConfigurationMaven · org.postgresql:postgresql · fixed in 42.7.7
- CVE-2025-30220GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-wfs · fixed in 2.27.1, 2.26.3, 2.25.7
- CVE-2025-30145GeoServer has an Infinite Loop Vulnerability in Jiffle processMaven · org.geoserver.extension:gs-wps-core, org.geoserver.web:gs-web-app +1 · fixed in 2.26.3, 2.25.7
- CVE-2025-27505GeoServer Missing Authorization on REST API IndexMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-rest · fixed in 2.26.3, 2.25.6
- CVE-2024-40625GeoServer Coverage REST API Allows Server Side Request ForgeryMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-rest · fixed in 2.26.0
- CVE-2024-38524GWC Home Page communicate version and revision informationMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-gwc · fixed in 2.26.2, 2.25.6
- CVE-2024-34711GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)Maven · org.geoserver.main:gs-main, org.geoserver.web:gs-web-app · fixed in 2.25.0