Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-47887Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permiMaven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 4.0.1-288.v8804b_ea_a_cb_7f
- CVE-2025-47886A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackersMaven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 4.0.1-288.v8804b_ea_a_cb_7f
- CVE-2025-47885Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, Maven · org.jenkins-ci.plugins:cloudbees-jenkins-advisor · fixed in 374.376.v3a_41a_a_142efe
- CVE-2025-47884In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values Maven · io.jenkins.plugins:oidc-provider · fixed in 111.v29fd614b_3617
- CVE-2025-4641XML External Entity (XXE) injection vulnerability in WebDriverManagerMaven · io.github.bonigarcia:webdrivermanager · fixed in 6.1.0
- CVE-2025-26864Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationMaven · org.apache.iotdb:node-commons · fixed in 1.3.4, 2.0.2
- CVE-2025-26795Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driverMaven · org.apache.iotdb:iotdb-jdbc · fixed in 1.3.4, 2.0.2
- CVE-2024-24780Apache IoTDB: Remote Code Execution with untrusted URI of User-defined functionMaven · org.apache.iotdb:iotdb-core · fixed in 1.3.4
- CVE-2025-46392Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xMaven · commons-configuration:commons-configuration
- CVE-2025-1948Eclipse Jetty HTTP clients can increase memory allocationMaven · org.eclipse.jetty.http2:jetty-http2-common · fixed in 12.0.17
- CVE-2024-13009Eclipse Jetty GZIP buffer releaseMaven · org.eclipse.jetty:jetty-server · fixed in 9.4.57.v20241219
- CVE-2025-46551JRuby-OpenSSL has hostname verification disabled by defaultMaven · org.jruby:jruby, rubygems:jruby-openssl · fixed in 10.0.0.1, 9.4.12.1, 0.15.4
- CVE-2025-46827Graylog Allows Session Takeover via Insufficient HTML SanitizationMaven · org.graylog2:graylog2-server · fixed in 6.0.14, 6.1.10
- CVE-2025-27533Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocationMaven · org.apache.activemq:activemq-client, org.apache.activemq:activemq-openwire-legacy · fixed in 5.16.8, 5.17.7, 5.18.7 and more
- CVE-2025-4388A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QMaven · com.liferay:com.liferay.marketplace.app.manager.web · fixed in 5.0.50
- CVE-2025-46762Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadataMaven · org.apache.parquet:parquet-avro · fixed in 1.15.2
- CVE-2025-2905An XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsMaven · org.wso2.am:am-distribution-parent · fixed in 2.1.0
- CVE-2025-45616Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.Maven · com.baidu.mapp:brcc-core
- CVE-2024-52979Elasticsearch Uncontrolled Resource Consumption vulnerabilityMaven · org.elasticsearch:elasticsearch · fixed in 7.17.25, 8.16.0
- CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST APIMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 14.10.22, 15.10.12, 16.4.3 and more
- CVE-2025-46557Any user with view access to the XWiki space can change the authenticatorMaven · org.xwiki.platform:xwiki-platform-security-authentication-ui · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1
- CVE-2025-46558org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown contentMaven · org.xwiki.contrib.markdown:syntax-markdown-commonmark12 · fixed in 8.9
- CVE-2025-32973org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming rightMaven · org.xwiki.platform:xwiki-platform-component-wiki · fixed in 15.10.12, 16.4.3, 16.8.0-rc-1
- CVE-2025-32974org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeMaven · org.xwiki.platform:xwiki-platform-security-requiredrights-default · fixed in 15.10.8, 16.2.0
- CVE-2025-32972The lesscss script service allows cache clearing without programming rightMaven · org.xwiki.platform:xwiki-platform-lesscss-script · fixed in 15.10.12, 16.4.3, 16.8.0-rc-1
- CVE-2025-32971XWiki Solr script service doesn't take dropped programming right into accountMaven · org.xwiki.platform:xwiki-platform-search-solr-api · fixed in 15.10.13, 16.4.4, 16.8.0-rc-1
- CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerabilityMaven · org.xwiki.platform:xwiki-platform-wysiwyg-api · fixed in 15.10.13, 16.4.4, 16.8.0
- CVE-2025-3910Org.keycloak.authentication: two factor authentication bypassMaven · org.keycloak:keycloak-services · fixed in 26.2.2
- CVE-2025-3501Org.keycloak.protocol.services: keycloak hostname verificationMaven · org.keycloak:keycloak-services · fixed in 26.2.2
- CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite ValveMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 9.0.104, 10.1.40, 11.0.6