Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62263OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassMaven · org.openidentityplatform.openam:openam-auth-webauthn · fixed in 16.1.2
- CVE-2026-46623OpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleMaven · org.openidentityplatform.openam:openam-auth-oauth2 · fixed in 16.1.1
- CVE-2026-46619OpenAM Authentication Bypass via MSISDN LDAP InjectionMaven · org.openidentityplatform.openam:openam-auth-msisdn · fixed in 16.1.1
- CVE-2026-46498OpenAM Arbitrary OAuth Token Minting via Push RegistrationMaven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-45794OpenAM Unsafe Java Deserialization via SNSMaven · org.openidentityplatform.openam:openam-push-notification · fixed in 16.1.1
- CVE-2026-45048OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-44203OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)Maven · org.openidentityplatform.openam:openam-oauth2 · fixed in 16.1.1
- CVE-2026-44202OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`Maven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-62379OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.2
- CVE-2026-53660OpenAM Insecure SSO Cookie InitializationMaven · org.openidentityplatform.openam:openam-core · fixed in 16.1.1
- CVE-2026-45052OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsMaven · org.openidentityplatform.openam:openam-federation-library · fixed in 16.1.1
- CVE-2026-44793OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`Maven · org.openidentityplatform.openam:openam-federation-library · fixed in 16.1.1
- CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserMaven · org.http4s:blaze-http_2.13, org.http4s:blaze-http_3 +1 · fixed in 0.23.18, 1.0.0-M42
- CVE-2026-53752docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceMaven · org.docx4j:docx4j-core · fixed in 11.5.14
- CVE-2026-53659http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSMaven · org.http4k:http4k-core · fixed in 6.49.0.0, 5.42.0.0
- CVE-2026-55847Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace renderingMaven · io.qameta.allure:allure-generator · fixed in 2.39.0
- CVE-2026-55846Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File ReadMaven · io.qameta.allure:allure-commandline · fixed in 2.39.0
- CVE-2026-34151XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+Maven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 17.10.5, 18.2.0
- CVE-2026-50270dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSMaven · com.datadoghq:dd-java-agent · fixed in 1.62.0
- CVE-2026-49439OpenRemote read-only asset users can write predicted datapointsMaven · io.openremote:openremote-manager · fixed in 1.24.1
- CVE-2026-49464NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taakMaven · nl.nl-portal:taak · fixed in 3.0.1
- CVE-2026-49463NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-librariesMaven · nl.nl-portal:besluiten, nl.nl-portal:documenten-api · fixed in 3.0.1
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceMaven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.10, 2.21.6, 2.22.2 and more
- CVE-2026-84939Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacksMaven · org.freemarker:freemarker · fixed in 2.3.35
- CVE-2026-86597Sensitive information written to logs by Snowflake driversMaven · net.snowflake:snowflake-jdbc, net.snowflake:snowflake-jdbc-fips +1 · fixed in 4.3.4
- CVE-2026-49832DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDNMaven · org.dspace:dspace-api · fixed in 8.4, 9.3, 10.0
- CVE-2026-49833DSpace: Path Traversal possible in LDN message generationMaven · org.dspace:dspace-api · fixed in 8.4, 9.3, 10.0
- CVE-2026-49831DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)Maven · org.dspace:dspace-api · fixed in 7.6.7, 8.4, 9.3 and more
- CVE-2026-49830DSpace: ORE resource URI does not validate scheme for non-web resourcesMaven · org.dspace:dspace-api · fixed in 7.6.7, 8.4, 9.3 and more
- CVE-2026-32773Apache Spark: XSS Vulnerability in Spark Web 3.5.4Maven · org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13 · fixed in 3.5.8