maven package report

Is com.github.penggle:kaptcha safe?

1 known vulnerability, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

1.3%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-8q89-pwhh-7wfq, the advisory selected below

// advisories

GHSA-8q89-pwhh-7wfq

CRITICALCVE-2018-18531

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.

Affected: <= 2.3.2
Fixed in: not stated
Weakness: CWE-330
Published: 2018-10-23
Source: github

GHSA NVD MITRE reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 03:29 UTC. The most recent advisory here was published 2018-10-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is com.github.penggle:kaptcha safe? maven package security report | CyberXYZ