Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote · fixed in 9.0.104, 10.1.40, 11.0.6
- CVE-2025-22235Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedMaven · org.springframework.boot:spring-boot · fixed in 3.3.11, 3.4.5
- CVE-2025-3986Apereo CAS CasConfigurationMetadataServerController.java redosMaven · org.apereo.cas:cas-server-core-configuration-metadata-repository
- CVE-2025-3985Apereo CAS ResponseEntity redosMaven · org.apereo.cas:cas-management-webapp-support
- CVE-2025-3984Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionMaven · org.apereo.cas:cas-management-webapp-support
- CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypassMaven · org.apache.httpcomponents.client5:httpclient5 · fixed in 5.4.3
- CVE-2025-32969org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 15.10.16, 16.4.6, 16.10.1
- CVE-2025-32968org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query APIMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 15.10.16, 16.4.6, 16.10.1
- CVE-2025-32961CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download EndpointMaven · com.haulmont.addon.jpawebapi:jpawebapi-jpawebapi · fixed in 1.1.1
- CVE-2025-32960CUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files EndpointMaven · com.haulmont.addon.restapi:restapi-rest-api · fixed in 7.2.7
- CVE-2025-32959CUBA Vulnerable to Denial of Service (DoS) in the File StorageMaven · com.haulmont.cuba:cuba-core · fixed in 7.2.23
- CVE-2025-32951io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST APIMaven · io.jmix.rest:jmix-rest · fixed in 1.6.2, 2.4.0
- CVE-2025-32952io.jmix.localfs:jmix-localfs affected by DoS in the Local File StorageMaven · io.jmix.localfs:jmix-localfs · fixed in 1.6.2, 2.4.0
- CVE-2025-32950io.jmix.localfs:jmix-localfs has a Path Traversal in Local File StorageMaven · io.jmix.localfs:jmix-localfs · fixed in 1.6.2, 2.4.0
- CVE-2024-41446A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a cMaven · org.opencms:opencms-core
- CVE-2024-42699Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payMaven · org.opencms:opencms-core
- CVE-2025-29287An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crMaven · net.mingsoft:ms-mcms · fixed in 5.4.4
- CVE-2024-41447A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a cMaven · org.opencms:opencms-core
- CVE-2025-3760A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, andMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2024.Q1.13, 2024.Q3.10, 2025.Q1.0 and more
- CVE-2024-55238OpenMetadata <=1.4.1 is vulnerable to SQL Injection.Maven · org.open-metadata:openmetadata-service
- CVE-2025-32783XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wikiMaven · org.xwiki.platform:xwiki-platform-messagestream
- CVE-2025-3588joelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflowMaven · org.jsonschema2pojo:jsonschema2pojo-core
- CVE-2025-27391Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logMaven · org.apache.activemq:artemis-project · fixed in 2.40.0
- CVE-2025-31672Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesMaven · org.apache.poi:poi-ooxml · fixed in 5.4.0
- CVE-2025-30677Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka ConnectorsMaven · org.apache.pulsar:pulsar-io-kafka, org.apache.pulsar:pulsar-io-kafka-connect-adaptor · fixed in 3.0.11, 3.3.6, 4.0.4
- CVE-2024-52981An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection oMaven · org.elasticsearch:elasticsearch · fixed in 7.17.24, 8.15.1
- CVE-2024-52980Elasticsearch Uncontrolled Resource Consumption vulnerabilityMaven · org.elasticsearch:elasticsearch-grok · fixed in 8.15.1
- CVE-2025-30373Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong valueMaven · org.graylog2:graylog2-server · fixed in 6.1.9
- CVE-2025-31487The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA serverMaven · org.xwiki.contrib.jira:jira-macro-default · fixed in 8.5.6
- CVE-2025-31728Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasinMaven · org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin