Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-27505GeoServer Missing Authorization on REST API IndexMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-rest · fixed in 2.26.3, 2.25.6
- CVE-2024-40625GeoServer Coverage REST API Allows Server Side Request ForgeryMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-rest · fixed in 2.26.0
- CVE-2024-38524GWC Home Page communicate version and revision informationMaven · org.geoserver.web:gs-web-app, org.geoserver:gs-gwc · fixed in 2.26.2, 2.25.6
- CVE-2024-34711GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)Maven · org.geoserver.main:gs-main, org.geoserver.web:gs-web-app · fixed in 2.25.0
- CVE-2024-29198GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostMaven · org.geoserver.web:gs-app, org.geoserver:gs-wfs · fixed in 2.24.4, 2.25.2
- CVE-2025-27817Apache Kafka Client: Arbitrary file read and SSRF vulnerabilityMaven · org.apache.kafka:kafka-clients · fixed in 3.9.1
- CVE-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configurationMaven · org.apache.kafka:kafka_2.10, org.apache.kafka:kafka_2.11 +6 · fixed in 3.4.0
- CVE-2025-27818Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configurationMaven · org.apache.kafka:kafka_2.11, org.apache.kafka:kafka_2.12 +1 · fixed in 3.9.1
- CVE-2025-49128Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationMaven · com.fasterxml.jackson.core:jackson-core · fixed in 2.13.0
- CVE-2025-27531Apache InLong: An arbitrary file read vulnerability for JDBCMaven · org.apache.inlong:inlong-manager · fixed in 2.1.0
- CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introducMaven · org.jenkins-ci.plugins:gatling
- CVE-2025-49009Para Inserts Sensitive Information into Log File for Facebook authenticationMaven · com.erudika:para-server · fixed in 1.50.8
- CVE-2025-35036hibernate-validator insecure default Expression Language interpolationMaven · org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator · fixed in 6.2.0.CR1, 7.0.0.CR1
- CVE-2025-46548Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effectiveMaven · com.lightbend.akka.management:akka-management_2.12, com.lightbend.akka.management:akka-management_2.13 +4 · fixed in 1.6.1, 1.1.1
- CVE-2025-45855An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary Maven · xyz.erupt:erupt
- CVE-2024-1440Open Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util · fixed in 7.0.111, 5.25.707
- CVE-2024-8008Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui · fixed in 7.5.12
- CVE-2025-48955Para Server Logs Sensitive InformationMaven · com.erudika:para-server · fixed in 1.50.8
- CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawMaven · org.wso2.am:am-parent, org.wso2.is:identity-server-parent · fixed in 4.4.0, 7.1.0
- CVE-2025-41235CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted ProxiesMaven · org.springframework.cloud:spring-cloud-gateway-server, org.springframework.cloud:spring-cloud-gateway-server-mvc · fixed in 4.2.3, 4.1.8, 3.1.10
- CVE-2025-48881Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized usersMaven · com.ritense.valtimo:object-management, com.ritense.valtimo:objecten-api · fixed in 12.13.0.RELEASE
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scriptsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 9.0.105, 10.1.41, 11.0.7
- CVE-2025-48734Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by defaultMaven · commons-beanutils:commons-beanutils, org.apache.commons:commons-beanutils2 · fixed in 1.11.0, 2.0.0-M2
- CVE-2025-27528Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File ReadMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-27526Apache InLong: JDBC Vulnerability For URLEncode and backspace bypassMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-27522Apache InLong: JDBC Vulnerability during verification processingMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-48382Fess has Insecure Temporary File PermissionsMaven · org.codelibs.fess:fess · fixed in 14.19.2
- CVE-2025-48063XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming rightMaven · org.xwiki.platform:xwiki-platform-security-authorization-bridge · fixed in 16.10.4, 17.1.0-rc-1
- CVE-2025-41232CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methodsMaven · org.springframework.security:spring-security-aspects, org.springframework.security:spring-security-core · fixed in 6.4.6
- CVE-2025-4949XXE vulnerability in Eclipse JGitMaven · org.eclipse.jgit:org.eclipse.jgit · fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r and more