GHSA-R7WM-3CXJ-WFF9 vulnerabilities

Vulnerabilities for packages: flyway, cass-config-builder, wildfly, strimzi-kafka-operator, dependency-track, apicurio-registry, gradle, infinispan, spdx-tools-java, tez...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, strimzi-kafka-operator-fips, zookeeper, keycloak-config-cli, flyway, akhq, kafbat-ui-fips, apache-activemq-fips, hono, cassandra-fips, zookeeper-fips, nuxeo, wavefront-proxy, ruby3.3-jrjackson, infinispan, tez, apicurio-registry-fips,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, zookeeper, keycloak-config-cli, flyway, akhq, kafbat-ui-fips, apache-activemq-fips, hono, cassandra-fips, zookeeper-fips, nuxeo, wavefront-proxy, ruby3.3-jrjackson, infinispan, tez, apache-activemq, flyway-fips, gradle, ruby3.2-jrjackson,...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, strimzi-kafka-operator-fips, zookeeper, keycloak-config-cli, flyway, akhq, kafbat-ui-fips, apache-activemq-fips, hono, cassandra-fips, zookeeper-fips, nuxeo, wavefront-proxy, ruby3.3-jrjackson, infinispan, tez, apicurio-registry-fips,...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: akhq, ruby3.2-jrjackson, zookeeper, strimzi-kafka-operator, keycloak-config-cli, apicurio-registry, gradle, confluent-kafka, apache-tika, infinispan, ruby3.3-jrjackson, wavefront-proxy, cassandra, tez...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: akhq, ruby3.2-jrjackson, zookeeper, strimzi-kafka-operator, keycloak-config-cli, apicurio-registry, gradle, confluent-kafka, apache-tika, infinispan, ruby3.3-jrjackson, wavefront-proxy, cassandra, tez...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: akhq, ruby3.2-jrjackson, zookeeper, keycloak-config-cli, gradle, confluent-kafka, apache-tika, infinispan, ruby3.3-jrjackson, wavefront-proxy, cassandra, tez...

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories blo...

PT-2026-60684

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049

CVE-2026-42049 affects jadx (Dex to Java decompiler). Before 1.5.6, exporting a decompiled APK as an Android Gradle project could cause the android:versionName from the manifest to be inserted into the generated app/build.gradle Groovy template without proper sanitization, enabling opening or bui...

GHSA-WG5P-8H9P-3MR7 agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution Summary agent-coderag unconditionally executes a repository-controlled gradlew script during its default sync dependency-discovery flow. An attacker who can induce a victim to index a malicious Gradle repository...

MAL-2026-4707 Malicious code in vue-compiler-sfc-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9 Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinstall hook runs...

Malicious code in vue-compiler-sfc-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9 Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinstall hook runs...

Unity Linux 20.1070e Security Update: gradle (UTSA-2026-016763)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016763 advisory. The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the sam...

com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01 <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01 <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01 <=7.0.0-alpha02)

com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...

Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...

GHSA-J8MX-J73W-9MXW Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build process exits with a non-zero status. Because the build environment may contain credentials...