Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagMaven · org.apache.wicket:wicket-core
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscoreMaven · org.apache.wicket:wicket-core
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderMaven · org.apache.wicket:wicket-core
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceMaven · org.apache.wicket:wicket-core
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesMaven · org.apache.wicket:wicket-core
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalMaven · org.apache.wicket:wicket-core
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataMaven · org.apache.wicket:wicket-extensions
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameMaven · org.apache.wicket:wicket-core
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inMaven · org.apache.wicket:wicket-core
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationMaven · org.apache.wicket:wicket-auth-roles
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentMaven · org.apache.wicket:wicket-core
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredMaven · org.apache.wicket:wicket-core
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionMaven · org.apache.wicket:wicket-core
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceMaven · org.apache.wicket:wicket-native-websocket-core
- CVE-2026-118636Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderMaven · org.apache.mina:mina-core
- RUSTSEC-2026-0434`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)crates.io · ant-releases
- CVE-2026-118938Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysisPyPI · fickling
- CVE-2026-16760Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablesPyPI · fickling
- CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGo · github.com/daptin/daptin
- CVE-2026-118563CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276Packagist · drupal/cacheflush
- CVE-2026-118564PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277Packagist · drupal/commerce_payumoney
- RUSTSEC-2026-0427`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)crates.io · sn-releases
- CVE-2026-112375Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsMaven · org.apache.kafka:kafka
- CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationMaven · org.apache.kafka:kafka-clients, org.apache.kafka:kafka-streams
- CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationMaven · org.apache.kafka:kafka-streams
- CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingMaven · org.apache.kafka:kafka
- CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersMaven · org.apache.kafka:kafka
- CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of…Maven · org.apache.kafka:kafka