Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-1440Open Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util · fixed in 7.0.111, 5.25.707
- CVE-2024-8008Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui · fixed in 7.5.12
- CVE-2025-48955Para Server Logs Sensitive InformationMaven · com.erudika:para-server · fixed in 1.50.8
- CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawMaven · org.wso2.am:am-parent, org.wso2.is:identity-server-parent · fixed in 4.4.0, 7.1.0
- CVE-2025-41235CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted ProxiesMaven · org.springframework.cloud:spring-cloud-gateway-server, org.springframework.cloud:spring-cloud-gateway-server-mvc · fixed in 4.2.3, 4.1.8, 3.1.10
- CVE-2025-48881Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized usersMaven · com.ritense.valtimo:object-management, com.ritense.valtimo:objecten-api · fixed in 12.13.0.RELEASE
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scriptsMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 9.0.105, 10.1.41, 11.0.7
- CVE-2025-48734Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by defaultMaven · commons-beanutils:commons-beanutils, org.apache.commons:commons-beanutils2 · fixed in 1.11.0, 2.0.0-M2
- CVE-2025-27528Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File ReadMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-27526Apache InLong: JDBC Vulnerability For URLEncode and backspace bypassMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-27522Apache InLong: JDBC Vulnerability during verification processingMaven · org.apache.inlong:manager-pojo · fixed in 2.2.0
- CVE-2025-48382Fess has Insecure Temporary File PermissionsMaven · org.codelibs.fess:fess · fixed in 14.19.2
- CVE-2025-48063XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming rightMaven · org.xwiki.platform:xwiki-platform-security-authorization-bridge · fixed in 16.10.4, 17.1.0-rc-1
- CVE-2025-41232CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methodsMaven · org.springframework.security:spring-security-aspects, org.springframework.security:spring-security-core · fixed in 6.4.6
- CVE-2025-4949XXE vulnerability in Eclipse JGitMaven · org.eclipse.jgit:org.eclipse.jgit · fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r and more
- CVE-2025-22233Spring Framework DataBinder Case Sensitive Match ExceptionMaven · org.springframework:spring-context · fixed in 6.2.7, 6.1.20
- CVE-2025-47889In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, alloMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2025-47888Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configMaven · io.jenkins.plugins:dingding-notifications
- CVE-2025-47887Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permiMaven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 4.0.1-288.v8804b_ea_a_cb_7f
- CVE-2025-47886A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackersMaven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 4.0.1-288.v8804b_ea_a_cb_7f
- CVE-2025-47885Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, Maven · org.jenkins-ci.plugins:cloudbees-jenkins-advisor · fixed in 374.376.v3a_41a_a_142efe
- CVE-2025-47884In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values Maven · io.jenkins.plugins:oidc-provider · fixed in 111.v29fd614b_3617
- CVE-2025-4641XML External Entity (XXE) injection vulnerability in WebDriverManagerMaven · io.github.bonigarcia:webdrivermanager · fixed in 6.1.0
- CVE-2025-26864Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationMaven · org.apache.iotdb:node-commons · fixed in 1.3.4, 2.0.2
- CVE-2025-26795Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driverMaven · org.apache.iotdb:iotdb-jdbc · fixed in 1.3.4, 2.0.2
- CVE-2024-24780Apache IoTDB: Remote Code Execution with untrusted URI of User-defined functionMaven · org.apache.iotdb:iotdb-core · fixed in 1.3.4
- CVE-2025-46392Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xMaven · commons-configuration:commons-configuration
- CVE-2025-1948Eclipse Jetty HTTP clients can increase memory allocationMaven · org.eclipse.jetty.http2:jetty-http2-common · fixed in 12.0.17
- CVE-2024-13009Eclipse Jetty GZIP buffer releaseMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.57.v20241219
- CVE-2025-46551JRuby-OpenSSL has hostname verification disabled by defaultMaven · org.jruby:jruby, rubygems:jruby-openssl · fixed in 10.0.0.1, 9.4.12.1, 0.15.4