Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-27603XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translationsMaven · com.xwiki.confluencepro:application-confluence-migrator-pro-ui · fixed in 1.2.0
- CVE-2025-27625In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attaMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.492.2, 2.500
- CVE-2025-27624A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users togglMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.500, 2.492.2
- CVE-2025-27623Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via RESTMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.492.2, 2.500
- CVE-2025-27622Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via RESMaven · org.jenkins-ci.main:jenkins-core · fixed in 2.500, 2.492.2
- CVE-2025-27508Emissary Use of a Broken or Risky Cryptographic AlgorithmMaven · gov.nsa.emissary:emissary · fixed in 8.24.0
- CVE-2025-27497OpenDJ Denial of Service (Dos) using alias loopMaven · org.openidentityplatform.opendj:opendj-server-legacy · fixed in 4.9.3
- CVE-2023-38693RCE in Lucee REST endpointMaven · org.lucee:lucee · fixed in 5.3.12.1, 5.4.3.2, 5.3.8.236 and more
- CVE-2025-23368Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliMaven · org.wildfly.core:wildfly-elytron-integration · fixed in 32.0.0.Beta3, 31.0.3.Final
- CVE-2024-55532Apache Ranger: Improper Neutralization of Formula Elements in a CSV FileMaven · org.apache.ranger:security-admin-web · fixed in 2.6.0
- CVE-2024-24778Apache StreamPipes: Resources Permission EscalationMaven · org.apache.streampipes:streampipes-parent · fixed in 0.97.0
- CVE-2025-1686Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inMaven · io.pebbletemplates:pebble
- CVE-2024-2321Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenMaven · org.wso2.am:am-parent, org.wso2.is:identity-server-parent
- CVE-2025-1634Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeoutMaven · io.quarkus:quarkus-resteasy · fixed in 3.19.1, 3.15.3.1, 3.8.6.1
- CVE-2025-1584opensolon Solon StaticMappings.java path traversalMaven · org.noear:solon-web-staticfiles · fixed in 3.0.9
- CVE-2025-24893Remote code execution as guest via SolrSearchMacros request in xwikiMaven · org.xwiki.platform:xwiki-platform-search-solr-ui · fixed in 15.10.11, 16.4.1
- CVE-2025-23020An issue was discovered in Kwik before 0.10.1.Maven · tech.kwik:kwik · fixed in 0.10.1
- CVE-2024-4028Keycloak-core: stored xss in keycloak when creating a items in admin consoleMaven · org.keycloak:keycloak-core
- CVE-2025-1391Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claimsMaven · org.keycloak:keycloak-services · fixed in 26.1.3, 26.0.10
- CVE-2024-56180Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code executionMaven · org.apache.eventmesh:eventmesh-meta-raft · fixed in 1.11.0
- CVE-2024-52577Apache Ignite: Possible RCE when deserializing incoming messages by the server nodeMaven · org.apache.ignite:ignite-core · fixed in 2.17.0
- CVE-2025-26511Cassandra-Lucene-Index allows bypass of Cassandra RBACMaven · com.instaclustr:cassandra-lucene-index-plugin · fixed in 4.0.17-1.0.0, 4.1.8-1.0.1
- CVE-2025-1247Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instanceMaven · io.quarkus:quarkus-rest, io.quarkus:quarkus-rest-deployment · fixed in 3.18.2, 3.15.3.1, 3.8.6.1
- CVE-2024-46910Apache Atlas: An authenticated user can perform XSS and potentially impersonate another userMaven · org.apache.atlas:apache-atlas · fixed in 2.4.0
- CVE-2024-32037GeoNetwork vulnerable to search end-point information disclosure in response headersMaven · org.geonetwork-opensource:gn-services · fixed in 4.4.5, 4.2.10
- CVE-2025-25193Denial of Service attack on windows app using NettyMaven · io.netty:netty-common · fixed in 4.1.118.Final
- CVE-2025-24970SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineMaven · io.netty:netty-handler · fixed in 4.1.118.Final
- CVE-2025-25247Apache Felix Webconsole: XSS in services consoleMaven · org.apache.felix:org.apache.felix.webconsole · fixed in 4.9.10, 5.0.10
- CVE-2024-57606SQL injection vulnerability in Beijing Guoju Information Technology Co., Ltd JeecgBoot v.3.7.2 allows a remote attacker to obtain sensitive Maven · org.jeecgframework.boot:jeecg-boot-common · fixed in 3.7.3
- CVE-2024-37358Apache James: denial of service through the use of IMAP literalsMaven · org.apache.james.protocols:protocols-imap · fixed in 3.7.6, 3.8.2