Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-31727Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controMaven · org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin
- CVE-2025-31726Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller wheMaven · org.jenkins-ci.plugins:stackhammer
- CVE-2025-31725Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be vieweMaven · org.ukiuni.monitor-remote-job-plugin:monitor-remote-job
- CVE-2025-31724Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files Maven · org.jenkins-ci.plugins:vmanager-plugin · fixed in 4.0.1
- CVE-2025-31723A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the Maven · io.jenkins.plugins:simple-queue · fixed in 1.4.7
- CVE-2025-31722In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackerMaven · org.jenkins-ci.plugins:templating-engine · fixed in 2.5.4
- CVE-2025-31721A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.504, 2.492.3
- CVE-2025-31720A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.504, 2.492.3
- CVE-2025-29085SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/eMaven · com.vip.saturn:saturn-console
- CVE-2025-30177Apache Camel: Camel-Undertow Message Header Injection via Improper FilteringMaven · org.apache.camel:camel-undertow · fixed in 4.10.3, 4.8.6
- CVE-2024-56325Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredMaven · org.apache.pinot:pinot-broker, org.apache.pinot:pinot-common +1 · fixed in 1.3.0
- CVE-2025-30065Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadataMaven · org.apache.parquet:parquet-avro · fixed in 1.15.1
- CVE-2025-27427Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permissionMaven · org.apache.activemq:artemis-server · fixed in 2.40.0
- CVE-2025-31129jooby-pac4j: deserialization of untrusted dataMaven · io.jooby:jooby-pac4j · fixed in 2.17.0, 3.7.0
- CVE-2025-29908Netty QUIC hash collision DoS attackMaven · io.netty.incubator:netty-incubator-codec-quic · fixed in 0.0.71.Final
- CVE-2025-2961opensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversalMaven · org.noear:solon-view
- CVE-2024-6875Infinispan: infinispan: rest compare api has buffer leakMaven · org.infinispan:infinispan-query
- CVE-2025-30067Apache Kylin: The remote code execution via jdbc urlMaven · org.apache.kylin:kylin · fixed in 5.0.2
- CVE-2024-48944Apache Kylin: SSRF vulnerability in the diagnosis apiMaven · org.apache.kylin:kylin-common-server · fixed in 5.0.2
- CVE-2025-2559Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakMaven · org.keycloak:keycloak-services
- CVE-2025-22223Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods.Maven · org.springframework.security:spring-security-core · fixed in 6.4.4
- CVE-2025-29313Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attMaven · org.opendaylight.sfc:odl-sfc-openflow-renderer, org.opendaylight.sfc:odl-sfc-ovs
- CVE-2025-29314Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to Maven · org.opendaylight.sfc:odl-sfc-openflow-renderer, org.opendaylight.sfc:odl-sfc-ovs
- CVE-2025-29315An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC SodiumMaven · org.opendaylight.sfc:sfc-parent
- CVE-2025-27553Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENTMaven · org.apache.commons:commons-vfs2 · fixed in 2.10.0
- CVE-2025-30474Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error messageMaven · org.apache.commons:commons-vfs2 · fixed in 2.10.0
- CVE-2025-2622aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserializationMaven · com.aizuda:snail-job
- CVE-2025-26796Apache Oozie: XSS in Oozie Web ConsoleMaven · org.apache.oozie:oozie-core
- CVE-2025-2565The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2024.Q3.1, 2024.Q1.13, 7.4.3.129
- CVE-2025-27888Apache Druid: Server-Side Request Forgery and Cross-Site ScriptingMaven · org.apache.druid:druid · fixed in 31.0.2, 32.0.1