Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-107285AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12, 2.16.1
- CVE-2026-107283AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12, 2.16.1
- CVE-2026-107282AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostMaven · org.asynchttpclient:async-http-client · fixed in 3.0.13, 2.16.1
- CVE-2026-107280AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukMaven · org.asynchttpclient:async-http-client · fixed in 3.0.13, 2.16.1
- CVE-2026-107231AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextMaven · org.asynchttpclient:async-http-client · fixed in 3.0.13, 2.16.1
- CVE-2026-107230AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsMaven · org.asynchttpclient:async-http-client · fixed in 3.0.14
- CVE-2026-107228AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)Maven · org.asynchttpclient:async-http-client · fixed in 3.0.14
- CVE-2026-107227AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledMaven · org.asynchttpclient:async-http-client · fixed in 3.0.14
- CVE-2026-106453yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorMaven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.2
- CVE-2026-106452yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerMaven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.2
- CVE-2026-106451yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userMaven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.4
- CVE-2026-106450yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsMaven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.4
- CVE-2026-106449yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorMaven · at.yawk.lz4:lz4-java, org.lz4:lz4-java · fixed in 1.11.4
- CVE-2026-106123RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()Maven · com.rabbitmq:amqp-client · fixed in 5.35.0
- CVE-2026-106122RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersMaven · com.rabbitmq:amqp-client · fixed in 5.36.0
- CVE-2026-106121RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSMaven · com.rabbitmq:amqp-client · fixed in 5.36.1
- CVE-2026-54049Sakai Conversations has a Stored XSS IssueMaven · org.sakaiproject.conversations:sakai-conversations-impl, org.sakaiproject.kernel:sakai-kernel-impl +1
- CVE-2026-103922Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathMaven · com.capacitorjs:core · fixed in 6.2.2, 7.6.9, 8.5.1 and more
- CVE-2026-92899Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceMaven · org.apache.wss4j:wss4j-ws-security-dom · fixed in 4.0.2, 3.0.6, 2.4.4
- CVE-2026-100834http4k before 6.48.0.0 Digest Authentication Replay Protection BypassMaven · org.http4k:http4k-security-digest · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-100725http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorageMaven · org.http4k:http4k-core · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-100724http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyMaven · org.http4k:http4k-core · fixed in 6.49.0.0, 5.42.0.0, 4.51.0.0
- CVE-2026-61741http4s-scala-xml has an XML External Entity (XXE) processing issueMaven · org.http4s:http4s-scala-xml_2.12, org.http4s:http4s-scala-xml_2.13 +1 · fixed in 0.24.1, 1.0.0-M39
- CVE-2026-59990Jawn: Uncontrolled nesting depth in JSON parserMaven · org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13 +1 · fixed in 1.7.0
- CVE-2026-61814Jawn: Quadratic parsing effort in AsyncParserMaven · org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13 +1 · fixed in 1.7.0
- CVE-2026-77420JLine: ReDoS via `HISTORY_IGNORE` Configuration VariableMaven · org.jline:jline-reader · fixed in 4.3.1, 3.30.15
- CVE-2026-77422JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingMaven · org.jline:jline-builtins · fixed in 4.3.1, 3.30.15
- CVE-2026-77421JLine: ReDoS in Nano Editor Regex Search ModeMaven · org.jline:jline-builtins · fixed in 4.3.1, 3.30.15
- CVE-2026-95848Moquette fails open when configured authentication or authorization classes cannot loadMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95847Moquette client IDs can cause cross-session H2 durable-queue corruptionMaven · io.moquette:moquette-broker · fixed in 0.18.1