org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

puput (2.0.0), wagtail-all-in-one-accessibility (>=1.1.0, <=1.8.0) +4 more potentially affected by CVE-2026-28222 via wagtail (5.0.5)

wagtail PYPI version 5.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - puput 2.0.0 - wagtail-all-in-one-accessibility =1.1.0, =5.0.0, =3.10.1, =0.0.1, =0.0.2 Source cves: CVE-2026-28222 Source advisory:...

aratinga (0.1.0a0.dev3), coop (7.1.0) +5 more potentially affected by CVE-2026-28222 via wagtail (>=7.1.0, <=7.1.3)

wagtail PYPI version =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.1.0b0 Source cves: CVE-2026-28222 Source advisory: OSV:PYSEC-2026-2307...

aratinga (0.1.0a0.dev3), coop (7.1.0) +5 more potentially affected by CVE-2026-28223 via wagtail (>=7.1.0, <=7.1.3)

wagtail PYPI version =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.1.0b0 Source cves: CVE-2026-28223 Source advisory: OSV:PYSEC-2026-2308...

Malicious Package

Overview pearpass-utils-password-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:servlet-message-spring-boot-starter (>=4.0.0.0-m2, <=4.0.0.0-m3) +800 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-http (>=12.1.0, <=12.1.4)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.2.1-alpha, =0.2.1-alpha, =4.0.0-1215, =4.0.0-1215, =2.4.2, =2.4.5 - com.github.cafaudit:caf-audit-service-container 5.0.5-1360 and more Source cves:...

CVE-2026-28110

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through =...

PT-2026-23437

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description The AVideo application's official docker-compose.yml file publishes the memcached service on host port 11211 0.0.0.0:11211 without authentication. The Dockerfile configures PHP to store all user sessio...

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw from 2026.1.14 to 2026.2.12 had security vulnerabilities. These vulnerabilities stemmed from improper network binding in the Chrome extension relay servers, which could cause the relay HTTP/WS servers to be bound to...

CVE-2025-12801

The CVE-2025-12801 issue affects the rpc.mountd daemon in the linux nfs-utils package. Affected component: rpc.mountd (NFSv3 context) in nfs-utils. Root cause/impact: a NFSv3 client can escalate privileges granted to it in the /etc/exports at mount time, enabling access to any subdirectory or sub...

RUSTSEC-2026-0075 All-Zero Key Generation on Catastrophic RNG Failure

The libcrux-ed25519 key generation samples Ed25519 secret keys from a provided CSPRNG in a loop for up to 100 attempts until a non-zero key is found. If a non-zero key could not be sampled within 100 attempts the key generation function would silently continue with an all-zero buffer as the secre...

All-Zero Key Generation on Catastrophic RNG Failure

The libcrux-ed25519 key generation samples Ed25519 secret keys from a provided CSPRNG in a loop for up to 100 attempts until a non-zero key is found. If a non-zero key could not be sampled within 100 attempts the key generation function would silently continue with an all-zero buffer as the secre...

org.apache.activemq:apache-activemq (4.1.2) potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (4.1.2)

org.apache.activemq:activemq-all MAVEN version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq:apache-activemq 4.1.2 Source cves: CVE-2025-66168 Source advisory:...

be.yildiz-games:module-messaging-activemq (>=1.0.0, <=1.0.1), cn.codeforfun:jfinal-activemq (0.3) +334 more potentially affected by CVE-2025-66168 +1 more via org.apache.activemq:activemq-all (>=5.0.0, <=5.19.1)

org.apache.activemq:activemq-all MAVEN version =5.0.0, =1.0.0, =6.0.03, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.3-rc1, =2.0.0-rc2, =1.1.6, =8.0.0-beta1, =2.0.0, =2.3.0 - com.freedomotic:base-objects 3.0 - com.freedomotic:essential 3.0 - com.freedomotic:freedomotic-core 5.6 and more...

org.apache.activemq.tooling:activemq-maven-plugin (6.2.0), org.apache.activemq:activemq-osgi (6.2.0) +4 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (6.2.0)

org.apache.activemq:activemq-all MAVEN version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq.tooling:activemq-maven-plugin 6.2.0 - org.apache.activemq:activemq-osgi 6.2...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.1.8) +5 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (>=6.0.0, <=6.1.8)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.8 Source cves: CVE-2025-66168 Source advisory: GHSA-C825-6PH3-4H84...

org.apache.activemq.tooling:activemq-maven-plugin (6.2.0), org.apache.activemq:activemq-osgi (6.2.0) +4 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (6.2.0)

org.apache.activemq:activemq-all MAVEN version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-all and may be impacted: - org.apache.activemq.tooling:activemq-maven-plugin 6.2.0 - org.apache.activemq:activemq-osgi 6.2...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.1.8) +5 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (>=6.0.0, <=6.1.8)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.8 Source cves: CVE-2025-66168 Source advisory: OSV:GHSA-C825-6PH3-4H84...

be.yildiz-games:module-messaging-activemq (>=1.0.0, <=1.0.1), cn.codeforfun:jfinal-activemq (0.3) +334 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (>=5.0.0, <=5.19.1)

org.apache.activemq:activemq-all MAVEN version =5.0.0, =1.0.0, =6.0.03, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.3-rc1, =2.0.0-rc2, =1.1.6, =8.0.0-beta1, =2.0.0, =2.3.0 - com.freedomotic:base-objects 3.0 - com.freedomotic:essential 3.0 - com.freedomotic:freedomotic-core 5.6 and more...

be.yildiz-games:module-messaging-activemq (>=1.0.0, <=1.0.1), cn.codeforfun:jfinal-activemq (0.3) +334 more potentially affected by CVE-2025-66168 via org.apache.activemq:activemq-all (>=5.0.0, <=5.19.1)

org.apache.activemq:activemq-all MAVEN version =5.0.0, =1.0.0, =6.0.03, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.3-rc1, =2.0.0-rc2, =1.1.6, =8.0.0-beta1, =2.0.0, =2.3.0 - com.freedomotic:base-objects 3.0 - com.freedomotic:essential 3.0 - com.freedomotic:freedomotic-core 5.6 and more...