Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-95846Moquette publishes Last-Will messages without enforcing write authorizationMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95845Moquette unbounded per-session message queues allow memory exhaustionMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95844Moquette deeply nested MQTT topics can cause stack exhaustionMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95843Moquette malformed shared subscriptions can crash command processingMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-95842Moquette uncaught MQTT command exceptions can terminate shared session event loopsMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-85724Moquette pattern ACL wildcard injection allows cross-tenant authorization bypassMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-91777jackson-databind: quadratic forward-reference completion in Collection and Map deserializersMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.21.7, 2.18.11, 2.22.3 and more
- CVE-2026-91776jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.11, 2.21.7, 2.22.3 and more
- CVE-2026-89425jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthMaven · com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core · fixed in 2.21.7, 2.22.3, 2.18.11 and more
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderMaven · net.sf.mpxj:mpxj · fixed in 16.4.1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersMaven · net.sf.mpxj:mpxj · fixed in 16.5.0
- CVE-2026-89407jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSMaven · com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core · fixed in 2.18.11, 2.21.7, 2.22.3 and more
- CVE-2026-69190Graylog: Manager-to-Owner privilege escalation on saved searches and dashboardsMaven · org.graylog2:graylog2-server · fixed in 6.3.14, 7.0.9, 7.1.4
- CVE-2026-85058Moquette: Missing Authorization in io.moquette:moquette-brokerMaven · io.moquette:moquette-broker · fixed in 0.18.1
- CVE-2026-54147http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIMaven · org.http4k:http4k-security-digest · fixed in 6.50.0.0, 5.42.0.0
- CVE-2026-54148http4k: `DigestAuthProvider.verify` did not bind to request URIMaven · org.http4k:http4k-security-digest · fixed in 6.50.0.0, 5.42.0.0, 4.51.0.0
- CVE-2025-53837org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueMaven · org.xwiki.rendering:xwiki-rendering-xml · fixed in 14.10.2
- CVE-2026-93451snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methodsMaven · org.xerial.snappy:snappy-java · fixed in 1.1.10.9
- CVE-2026-77615Paella Player: Stored XSS via caption cue textMaven · org.opencastproject:opencast-engage-paella-player-7 · fixed in 19.7, 20.2
- CVE-2026-54617GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandlerMaven · pro.gravit.launcher:launchserver-api
- CVE-2026-85716AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12
- CVE-2026-85720AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12, 2.16.1
- CVE-2026-85721AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12, 2.16.1
- CVE-2026-85717AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect targetMaven · org.asynchttpclient:async-http-client · fixed in 3.0.12, 2.16.1
- CVE-2026-61700MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requestsMaven · org.mariadb.jdbc:mariadb-java-client · fixed in 2.7.14, 3.3.5, 3.4.3 and more
- CVE-2026-86071Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction rootMaven · com.github.junrar:junrar · fixed in 7.6.1
- CVE-2026-81876HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceMaven · ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.validation +1 · fixed in 6.9.12
- CVE-2026-81875HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceMaven · ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.validation +1 · fixed in 6.9.12
- CVE-2026-75516RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementMaven · com.rabbitmq:amqp-client · fixed in 5.34.0
- CVE-2026-63126Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)Maven · com.squareup.wire:wire-runtime · fixed in 6.4.5, 7.0.0-alpha04