org.webjars.npm:archive-type (4.0.0), org.webjars.npm:decompress-tar (4.1.1) +2 more potentially affected by CVE-2026-31808 via org.webjars.npm:file-type (>=3.9.0, <=5.2.0)

org.webjars.npm:file-type MAVEN version =3.9.0, =5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:file-type and may be impacted: - org.webjars.npm:archive-type 4.0.0 - org.webjars.npm:decompress-tar 4.1.1 -...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-31802 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-31802 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15456202...

BIT-MAVEN-2021-26291 block repositories using http by default

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

PT-2026-24611

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

org.webjars.npm:browser-sync-ui (2.27.11), org.webjars.npm:bulma (1.0.0) +21 more potentially affected by CVE-2026-29063 via org.webjars.npm:immutable (>=3.7.6, <=5.1.3)

org.webjars.npm:immutable MAVEN version =3.7.6, =0.7.0, =0.8.3, =0.8.4 - org.webjars.npm:flux 2.1.1 - org.webjars.npm:github-com-codeforms-punica-css-framework 3.0.0 - org.webjars.npm:github-com-datatables-datatablessrc 2.0.5 - org.webjars.npm:github-com-digicorp-propeller 1.3.2 -...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-3520 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-3520 Source advisory:...

org.glassfish.mq:mq-client (>=6.4.0, <=6.9.0), org.glassfish.mq:mq-cluster (>=6.4.0, <=6.9.0) +12 more potentially affected by CVE-2026-22886 via org.glassfish.mq:mqbroker-core (>=6.4.0, <=6.9.0)

org.glassfish.mq:mqbroker-core MAVEN version =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.9.0 Source cves: CVE-2026-22886 Source advisory: SNYK:JAVA-ORGGLASSFISHMQ-15444256...

com.github.psi-probe:psi-probe-tomcat10 (>=5.0.0, <=5.4.0), com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.4.0) +5 more potentially affected by CVE-2026-3268 via com.github.psi-probe:psi-probe-core (>=3.0.0, <=5.4.0)

com.github.psi-probe:psi-probe-core MAVEN version =3.0.0, =5.0.0, =5.0.0, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =5.4.0 Source cves: CVE-2026-3268 Source advisory: SNYK:JAVA-COMGITHUBPSIPROBE-15369740...

com.github.psi-probe:psi-probe-tomcat10 (>=5.0.0, <=5.4.0), com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.4.0) +5 more potentially affected by CVE-2026-3270 via com.github.psi-probe:psi-probe-core (>=3.0.0, <=5.4.0)

com.github.psi-probe:psi-probe-core MAVEN version =3.0.0, =5.0.0, =5.0.0, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =5.4.0 Source cves: CVE-2026-3270 Source advisory: SNYK:JAVA-COMGITHUBPSIPROBE-15369739...

com.github.psi-probe:psi-probe-tomcat10 (>=5.0.0, <=5.4.0), com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.4.0) +5 more potentially affected by CVE-2026-3269 via com.github.psi-probe:psi-probe-core (>=3.0.0, <=5.4.0)

com.github.psi-probe:psi-probe-core MAVEN version =3.0.0, =5.0.0, =5.0.0, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =3.0.0.rc2, =5.4.0 Source cves: CVE-2026-3269 Source advisory: SNYK:JAVA-COMGITHUBPSIPROBE-15369738...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.120.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.104.0) +25 more potentially affected by CVE-2026-27942 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.28.0 and more Source cves: CVE-2026-27942 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15353392...

org.webjars.npm:github-com-datatables-datatablessrc (2.0.5), org.webjars.npm:vite (>=2.9.0, <=6.3.5) +1 more potentially affected by CVE-2026-27606 via org.webjars.npm:rollup (>=2.79.2, <=4.45.1)

org.webjars.npm:rollup MAVEN version =2.79.2, =2.9.0, =6.3.5 - org.webjars.npm:vitepress 1.0.0-draft.8 Source cves: CVE-2026-27606 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15340921...

On the Variability of Source Code in Maven Package Rebuilds

Rebuilding packages from open source is a common practice to improve the security of software supply chains, and is now done at an industrial scale. The basic principle is to acquire the source code used to build a package published in a repository such as Maven Central for Java, rebuild the...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4603 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4603 Source advisory:...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4602 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4602 Source advisory:...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +35 more potentially affected by CVE-2026-2818 via org.springframework.data:spring-data-geode (>=1.0.0.incubating-release, <=2.7.18)

org.springframework.data:spring-data-geode MAVEN version =1.0.0.incubating-release, =0.3.12, =0.3.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =3.0.0, =3.2.1...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +35 more potentially affected by CVE-2026-2817 via org.springframework.data:spring-data-geode (>=1.0.0.incubating-release, <=2.7.18)

org.springframework.data:spring-data-geode MAVEN version =1.0.0.incubating-release, =0.3.12, =0.3.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =3.0.0, =3.2.1...

net.mingsoft:ms-mweixin (1.0.7) potentially affected by CVE-2026-2666 via net.mingsoft:ms-mcms (6.2.0)

net.mingsoft:ms-mcms MAVEN version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.mingsoft:ms-mcms and may be impacted: - net.mingsoft:ms-mweixin 1.0.7 Source cves: CVE-2026-2666 Source advisory: SNYK:JAVA-NETMINGSOFT-15323728...

com.codbex.atlas:codbex-atlas-application (>=2.62.0, <=2.120.0), com.codbex.gaia:codbex-gaia-application (>=2.61.0, <=2.104.0) +25 more potentially affected by CVE-2026-26278 via org.webjars.npm:fast-xml-parser (>=4.5.3, <=5.8.0)

org.webjars.npm:fast-xml-parser MAVEN version =4.5.3, =2.62.0, =2.61.0, =2.52.0, =2.52.0, =2.51.0, =2.51.0, =3.6.0, =2.50.0, =5.0.0, =5.0.0, =11.58.0, =12.2.0, =11.58.0, =11.58.0, =14.19.0, =14.28.0 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15325721...

org.webjars.npm:jsrsasign-util (1.0.5) potentially affected by CVE-2026-4599 via org.webjars.npm:jsrsasign (11.1.0)

org.webjars.npm:jsrsasign MAVEN version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:jsrsasign and may be impacted: - org.webjars.npm:jsrsasign-util 1.0.5 Source cves: CVE-2026-4599 Source advisory:...