Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-88975Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZEMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.37, 1.0.0-M48
- CVE-2026-69206Http4s: DigestAuth allows replay of captured requestsMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69202Http4s Ember HTTP/2: unbounded inbound body bufferingMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69218Http4s Ember HTTP/2: unbounded continuation frame accumulationMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69203Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMSMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69215Http4s: CookieJar middleware matches by substring, leaking cookies cross-originMaven · org.http4s:http4s-client_2.12, org.http4s:http4s-client_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69205Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)Maven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69213Http4s Ember HTTP/2: unbounded outbound frame queueMaven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69214Http4s: CookieJar middleware accepts arbitrary Set-Cookie domainMaven · org.http4s:http4s-client_2.12, org.http4s:http4s-client_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69201Http4s: ResourceService and Webjar Service path escape via percent-encoded separatorsMaven · org.http4s:http4s-server_2.12, org.http4s:http4s-server_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69216Http4s: Ember chunk parser lenience (TE.TE request smuggling)Maven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69208Http4s: DigestAuth nonce map grows unboundedMaven · org.http4s:http4s-ember-server_2.12, org.http4s:http4s-ember-server_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-69204Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)Maven · org.http4s:http4s-ember-core_2.12, org.http4s:http4s-ember-core_2.13 +1 · fixed in 0.23.35, 1.0.0-M47
- CVE-2026-55225Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`Maven · io.strimzi:strimzi · fixed in 1.0.1
- CVE-2026-55226Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operatorMaven · io.strimzi:strimzi · fixed in 1.0.1
- CVE-2026-54251netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of ServiceMaven · io.netty.incubator:netty-incubator-codec-ohttp · fixed in 0.0.23.Final
- CVE-2026-54050Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile ImageMaven · org.sakaiproject.profile2:profile2-api, org.sakaiproject.profile2:profile2-impl · fixed in 23.5
- CVE-2026-55864GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD ToolMaven · org.geonetwork-opensource:gn-web-app · fixed in 4.4.12, 4.2.17
- CVE-2026-65831ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file readMaven · com.arcadedb:arcadedb-server · fixed in 26.7.1
- CVE-2026-54077ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersMaven · com.arcadedb:arcadedb-engine · fixed in 26.6.1
- CVE-2026-54076ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)Maven · com.arcadedb:arcadedb-engine · fixed in 26.6.1
- CVE-2026-53966XWiki Platform: Privilege escalation from edit to script right through Live Data editingMaven · org.xwiki.platform:xwiki-platform-livedata-livetable · fixed in 16.10.17, 17.4.10, 17.10.4 and more
- CVE-2026-46495OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIMaven · org.openidentityplatform.opendj:opendj-server-legacy · fixed in 5.1.1
- CVE-2026-48722Nextflow: Incorrect default permissions in the nextflow auth login commandMaven · io.nextflow:nextflow · fixed in 25.10.6, 26.04.3
- CVE-2026-48717OpenAM OAuth Authorization Bypass via PKCE ChallengeMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-47426OpenAM OAuth Client Impersonation via JWKS Resolver CacheMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-47424OpenAM Authenticated RCE via Groovy Sandbox EscapeMaven · org.openidentityplatform.openam:openam-scripting · fixed in 16.1.1
- CVE-2026-41573OpenAM LDAP Injection via `_queryId` ParameterMaven · org.openidentityplatform.openam:openam-core-rest · fixed in 16.1.1
- CVE-2026-62280OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent pageMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.2
- CVE-2026-45051OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageMaven · org.openidentityplatform.openam:openam-auth-webauthn · fixed in 16.1.1