Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-114456Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversNuGet · snowflake.data · fixed in 6.3.0
- CVE-2026-103582Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)NuGet · apache.nms.activemq
- GHSA-P3JP-9V83-76W9Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityNuGet · microsoft.dotnet.ilcompiler, microsoft.netcore.app.runtime.android-arm +75 · fixed in 8.0.33, 9.0.22, 10.0.14 and more
- CVE-2026-62847Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)NuGet · metalama.framework, metalama.tool · fixed in 2026.1.19, 2025.1.18, 2026.0.25
- CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionNuGet · metalama.framework · fixed in 2026.1.19, 2025.1.18, 2026.0.25
- GHSA-473Q-M89C-GHF8MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificatNuGet · mysqlconnector · fixed in 2.6.1
- CVE-2026-116675TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationNuGet · tinymce · fixed in 8.9.3, 7.9.4
- CVE-2026-92707MessagePack: Nested arrays can blow past buffer length limitsNuGet · messagepack · fixed in 2.5.303, 3.1.9
- CVE-2026-102870ASP.NET Core Remote Code Execution VulnerabilityNuGet · microsoft.aspnetcore.components.webassembly.server · fixed in 10.0.14, 11.0.0-rc.3.26522.148
- CVE-2026-88092ASP.NET Core Tampering VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +9 · fixed in 8.0.32, 10.0.13, 11.0.0-rc.2 and more
- CVE-2026-70197.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 8.0.32, 11.0.0-rc.2, 9.0.21 and more
- CVE-2026-106118ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeNuGet · sixlabors.imagesharp · fixed in 3.2.0, 4.1.1
- CVE-2026-106117ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharpNuGet · imagesharp · fixed in 3.2.0, 4.1.1
- CVE-2026-106116ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106115ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output bufferNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106114ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsNuGet · sixlabors.imagesharp · fixed in 4.1.2, 3.2.0
- CVE-2026-106113ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106112ImageSharp: ICC LUT16 output channel count can write beyond Vector4NuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106111ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-106110ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferNuGet · sixlabors.imagesharp · fixed in 4.1.2
- CVE-2026-105796Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.35.0
- CVE-2026-105795Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.35.0
- CVE-2026-105794MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLNuGet · microsoft.native.quic.msquic.openssl · fixed in 2.4.20, 2.5.11, 2.6.1
- CVE-2026-100369CliInvoke: Argument Injection in Extensibility Runner FactoryNuGet · alastairlundy.cliinvoke, cliinvoke · fixed in 2.0.2, 2.8.5, 2.9.4 and more
- CVE-2026-100368CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappersNuGet · alastairlundy.cliinvoke.specializations, cliinvoke.specializations · fixed in 2.0.2, 2.8.5, 2.9.4 and more
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderNuGet · mpxj.net, net.sf.mpxj +2 · fixed in 16.4.1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersNuGet · mpxj.net, net.sf.mpxj +2 · fixed in 16.5.0
- CVE-2026-69197Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionNuGet · umbraco.cms · fixed in 13.15.1, 17.5.3, 18.0.2
- CVE-2026-81515Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)NuGet · steeltoe.discovery.eureka · fixed in 4.3.0
- CVE-2026-81516Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)NuGet · steeltoe.discovery.consul · fixed in 4.3.0