ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.17), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.17) +5 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.17)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.17 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.17 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.111), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.111) +9 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.111)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.111 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.111 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.0.0, <=5.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.0.0, <=5.0.2) +65 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-converter (>=4.0.0, <=4.0.1) +7 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.2.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.2.0, <=6.2.5) +84 more potentially affected by CVE-2026-33180 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.68)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.68 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0,...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...

MAL-2026-1108 Malicious code in hapi-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90adf52f1b608bcddb8f6471e64ded19817bef1b8aa1715256182f0e7a3ab690 The package hapi-lint was found to contain malicious code. Source: ghsa-malware 388b8a57423bf6789ce0a82c22d6856663fcbc1cd2ff7ce5c6f7ef701567c19e Any...

Malware in hapi-lint

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in hapi-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90adf52f1b608bcddb8f6471e64ded19817bef1b8aa1715256182f0e7a3ab690 The package hapi-lint was found to contain malicious code. Source: ghsa-malware 388b8a57423bf6789ce0a82c22d6856663fcbc1cd2ff7ce5c6f7ef701567c19e Any...

Malicious Package

Overview hapi-lint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2019-12741

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=8.0.0, <=8.6.8), ca.uhn.hapi.fhir:hapi-fhir-docs (>=8.0.0, <=8.6.8) +333 more potentially affected by CVE-2025-66021 via com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (20240325.1)

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer MAVEN version 20240325.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer and may be impacted: -...