Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-45626Apache James: denial of service through JMAP HTML to text conversionMaven · org.apache.james:james-server-jmap-draft · fixed in 3.8.2, 3.7.6
- CVE-2024-57699A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1.Maven · net.minidev:json-smart · fixed in 2.5.2
- CVE-2024-27137Apache Cassandra: unrestricted deserialization of JMX authentication credentialsMaven · org.apache.cassandra:cassandra-all · fixed in 5.0.3, 4.1.8, 4.0.15
- CVE-2025-24860Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regionsMaven · org.apache.cassandra:cassandra-all · fixed in 4.0.16, 4.1.8, 5.0.3
- CVE-2025-23015Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actionsMaven · org.apache.cassandra:cassandra-all · fixed in 5.0.3, 4.1.8, 4.0.16 and more
- CVE-2025-0148Zoom Jenkins Marketplace plugin - Missing Password Field MaskingMaven · io.jenkins.plugins:zoom · fixed in 1.6
- CVE-2025-24961Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3ProxyMaven · org.gaul:s3proxy · fixed in 2.6.0
- CVE-2025-23215PMD Designer's release key passphrase (GPG) available on Maven Central in cleartextMaven · net.sourceforge.pmd:pmd-core, net.sourceforge.pmd:pmd-designer +1 · fixed in 7.10.0
- CVE-2025-0142Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive InformationMaven · io.jenkins.plugins:zoom · fixed in 1.4
- CVE-2025-23367Org.wildfly.core:wildfly-server: wildfly improper rbac permissionMaven · org.wildfly.core:wildfly-server · fixed in 27.0.1.Final, 28.0.0.Beta2
- CVE-2025-0851Path traversal issue in Deep Java LibraryMaven · ai.djl:api · fixed in 0.31.1
- CVE-2025-24790Snowflake JDBC uses insecure temporary credential cache file permissionsMaven · net.snowflake:snowflake-jdbc · fixed in 3.22.0
- CVE-2025-24789Snowflake JDBC allows an untrusted search path on WindowsMaven · net.snowflake:snowflake-jdbc · fixed in 3.22.0
- CVE-2024-57436RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring.Maven · com.ruoyi:ruoyi
- CVE-2024-57438Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.Maven · com.ruoyi:ruoyi
- CVE-2024-57439An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicMaven · com.ruoyi:ruoyi
- CVE-2024-29869Apache Hive: Credentials file created with non restrictive permissionsMaven · org.apache.hive:hive-exec · fixed in 4.0.1
- CVE-2025-0736Org.infinispan-infinispan-parent: exposure of sensitive information in application logsMaven · org.infinispan:infinispan-parent
- CVE-2024-23953Apache Hive: Timing Attack Against Signature in LLAP utilMaven · org.apache.hive:hive-llap-common · fixed in 4.0.0
- CVE-2025-24783Apache Cocoon: continuations may not be privateMaven · org.apache.cocoon:cocoon-forms-impl, org.apache.cocoon:cocoon-sitemap-impl
- CVE-2025-24814Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted filesMaven · org.apache.solr:solr-core · fixed in 9.8.0
- CVE-2024-52012Apache Solr: Configset upload on Windows allows arbitrary path write-accessMaven · org.apache.solr:solr-core · fixed in 9.8.0
- CVE-2025-24363The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential informationMaven · org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli, org.hl7.fhir.publisher:org.hl7.fhir.publisher.core · fixed in 1.8.9
- CVE-2024-52807XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`Maven · org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli, org.hl7.fhir.publisher:org.hl7.fhir.publisher.core · fixed in 1.7.4
- CVE-2024-53299Apache Wicket: An attacker can intentionally trigger a memory leakMaven · org.apache.wicket:wicket-core · fixed in 8.17.0, 10.3.0, 9.19.0
- CVE-2025-24403A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerateMaven · org.jenkins-ci.plugins:service-fabric
- CVE-2025-24402A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a SeMaven · org.jenkins-ci.plugins:service-fabric
- CVE-2025-24401Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted Maven · io.jenkins.plugins:folder-auth
- CVE-2025-24400Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, aMaven · com.axis.jenkins.plugins.eiffel:eiffel-broadcaster · fixed in 2.10.3
- CVE-2025-24399Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insMaven · org.jenkins-ci.plugins:oic-auth · fixed in 4.453.v4d7765c854f4