Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-24398Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF pMaven · io.jenkins.plugins:atlassian-bitbucket-server-integration · fixed in 4.1.4
- CVE-2025-24397An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lackiMaven · org.jenkins-ci.plugins:gitlab-plugin · fixed in 1.9.7
- CVE-2025-0604Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloakMaven · org.keycloak:keycloak-ldap-federation · fixed in 26.1.3, 26.0.10
- CVE-2024-56923Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6Maven · org.silverpeas.core:silverpeas-core · fixed in 6.4.2
- CVE-2024-45479Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhostMaven · org.apache.ranger:ranger · fixed in 2.5.0
- CVE-2024-45478Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user inputMaven · org.apache.ranger:ranger · fixed in 2.5.0
- CVE-2024-43709Elasticsearch allocation of resources without limits or throttling leads to crashMaven · org.elasticsearch:elasticsearch · fixed in 7.17.21, 8.13.3
- CVE-2025-23184Apache CXF: Denial of Service vulnerability with temporary filesMaven · org.apache.cxf:cxf-core · fixed in 3.5.10, 3.6.5, 4.0.6
- CVE-2025-23025Privilege escalation (PR) through realtime WYSIWYG editing in XWikiMaven · org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui · fixed in 15.10.12, 16.4.1, 16.6.0-rc-1
- CVE-2025-23366Org.jboss.hal:hal-console: wildfly hal console cross-site scriptingMaven · org.jboss.hal:hal-console · fixed in 3.7.7.Final
- CVE-2024-45627Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerabilityMaven · org.apache.linkis:linkis-metadata-query-service-jdbc · fixed in 1.7.0
- CVE-2024-11736Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variablesMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.0.8
- CVE-2024-11734Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.0.8
- CVE-2025-23026HTML templates containing Javascript template strings are subject to XSS in jteMaven · gg.jte:jte, gg.jte:jte-runtime · fixed in 3.1.16
- CVE-2024-54676Apache OpenMeetings: Deserialisation of untrusted data in cluster modeMaven · org.apache.openmeetings:openmeetings-parent · fixed in 8.0.0
- CVE-2024-8447Narayana: deadlock via multiple join requests sent to lra coordinatorMaven · org.jboss.narayana.rts:lra-coordinator-jar · fixed in 7.1.0.Final
- CVE-2024-56512Apache NiFi: Missing Complete Authorization for Parameter and Service ReferencesMaven · org.apache.nifi:nifi-web-api · fixed in 2.1.0
- CVE-2024-52046Apache MINA: MINA applications using unbounded deserialization may allow RCEMaven · org.apache.mina:mina-core · fixed in 2.2.4, 2.1.10, 2.0.27
- CVE-2024-12744SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31Maven · com.amazon.redshift:redshift-jdbc42 · fixed in 2.1.0.32
- CVE-2024-43441Apache HugeGraph-Server: Fixed JWT Token(Secret)Maven · org.apache.hugegraph:hugegraph-server · fixed in 1.5.0
- CVE-2024-23945Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification failsMaven · org.apache.hive:hive-service, org.apache.spark:spark-hive-thriftserver_2.11 +1 · fixed in 4.0.0, 3.4.2
- CVE-2024-56337Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina +1 · fixed in 11.0.2, 10.1.34, 9.0.98
- CVE-2024-38819Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksMaven · org.springframework:spring-webflux, org.springframework:spring-webmvc · fixed in 6.1.14
- CVE-2024-12801SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacksMaven · ch.qos.logback:logback-core · fixed in 1.5.13, 1.3.15
- CVE-2024-12798JaninoEventEvaluator vulnerabilityMaven · ch.qos.logback:logback-core · fixed in 1.5.13, 1.3.15
- CVE-2024-56128Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryptionMaven · org.apache.kafka:kafka_2.10, org.apache.kafka:kafka_2.11 +2 · fixed in 3.7.2, 3.8.1
- CVE-2024-10973Keycloak: cli option for encrypted jgroups ignoredMaven · org.keycloak:keycloak-quarkus-server · fixed in 26.0.6
- CVE-2023-37940Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.Maven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.3.10.u30, 7.4.13.u88, 7.4.3.88
- CVE-2024-12539Elasticsearch Incorrect AuthorizationMaven · org.elasticsearch:elasticsearch · fixed in 8.16.2
- CVE-2024-11993Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allowsMaven · com.liferay.portal:release.dxp.bom, com.liferay.portal:release.portal.bom · fixed in 7.4.13.u39, 7.4.3.39