Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-10549Denial of Service by ReDOS in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-8062Denial of Service in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-7768Denial of Service in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-6863Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-8616Arbitrary File Overwrite in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-10550Denial of Service by ReDOS in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-6854Arbitrary File Overwrite in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-10572Denial of Service and Arbitrary File Write in h2oai/h2o-3Maven · ai.h2o:h2o-ext-xgboost
- CVE-2024-10553Jdbc Deserialization in h2oai/h2o-3Maven · ai.h2o:h2o-core · fixed in 3.46.0.6
- CVE-2024-7765Denial of Service in h2oai/h2o-3Maven · ai.h2o:h2o-core
- CVE-2024-54016compression bomb attack in Apache Seata ServerMaven · org.apache.seata:seata-parent · fixed in 2.3.0
- CVE-2024-47552Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata ServerMaven · org.apache.seata:seata-config-core · fixed in 2.2.0
- CVE-2025-22228CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthMaven · org.springframework.security:spring-security-crypto · fixed in 6.3.8, 6.4.4, 6.2.10 and more
- CVE-2025-2536Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 2024.Q1.13, 2024.Q4.0, 2024.Q3.1 and more
- CVE-2025-29926The WikiManager REST API allows any user to create wikisMaven · org.xwiki.platform:xwiki-platform-wiki-rest-default · fixed in 15.10.15, 16.4.6, 16.10.0
- CVE-2025-29925XWiki allows unregistered users to access private pages information through REST endpointMaven · org.xwiki.platform:xwiki-platform-rest-server · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1
- CVE-2025-29924XWiki uses the wrong wiki reference in AuthorizationManagerMaven · org.xwiki.platform:xwiki-platform-security-authorization-api · fixed in 15.10.14, 16.4.6, 16.10.0-rc-1
- CVE-2025-30197Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attMaven · io.jenkins.plugins:zohoqengine · fixed in 1.0.31.v4a_b_1db_6d6a_f2
- CVE-2025-30196Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` schemeMaven · org.jenkins-ci.plugins:anchorchain
- CVE-2024-58103Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.Maven · com.squareup.wire:wire-runtime · fixed in 5.2.0
- CVE-2025-27496Snowflake JDBC Driver client-side encryption key in DEBUG logsMaven · net.snowflake:snowflake-jdbc · fixed in 3.23.1
- CVE-2020-36843The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA Maven · net.i2p.crypto:eddsa, net.i2p:i2p · fixed in 0.9.39
- CVE-2025-27017Apache NiFi: Potential Insertion of MongoDB Password in Provenance RecordMaven · org.apache.nifi:nifi-mongodb-services · fixed in 2.3.0
- CVE-2025-27867Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole PluginMaven · org.apache.felix:org.apache.felix.http.webconsoleplugin · fixed in 1.2.2
- CVE-2025-2240Smallrye-fault-tolerance: smallrye fault toleranceMaven · io.smallrye:smallrye-fault-tolerance-core · fixed in 6.4.2, 6.9.0
- CVE-2025-29891Apache Camel: Camel Message Header Injection through request parametersMaven · org.apache.camel:camel-support · fixed in 3.22.4, 4.10.2, 4.8.5
- CVE-2025-27136LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) InjectionMaven · io.github.robothy:local-s3-rest · fixed in 1.21
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina · fixed in 11.0.3, 10.1.35, 9.0.99
- CVE-2025-27636Apache Camel: Camel Message Header Injection via Improper FilteringMaven · org.apache.camel:camel-support · fixed in 3.22.4, 4.8.5, 4.10.2
- CVE-2025-27604XWiki Confluence Migrator Pro's homepage is publicMaven · com.xwiki.confluencepro:application-confluence-migrator-pro-ui · fixed in 1.11.7