Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-81868Steeltoe: Header-forwarded client cert lacks proof of private-key possessionNuGet · steeltoe.security.authorization.certificate · fixed in 4.3.0
- CVE-2026-75523Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secretsNuGet · steeltoe.management.endpoint · fixed in 4.3.0
- CVE-2026-75513Marten: SQL injection in Marten's LINQ provider via unescaped string literalsNuGet · marten · fixed in 9.13.0
- CVE-2026-85756SSH.NET: ScpClient allows server-side RCE via default SCP path handlingNuGet · ssh.net · fixed in 2026.0.0
- CVE-2026-54632SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)NuGet · sipsorcery · fixed in 10.0.9
- CVE-2026-81192OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSNuGet · opentelemetry.resources.host · fixed in 1.16.0-beta.2
- CVE-2026-71328.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-69304ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.server.iisintegration · fixed in 11.0.0-rc.1, 8.0.31, 9.0.20 and more
- CVE-2026-69439.NET and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-72923Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionNuGet · microsoft.openapi.readers, microsoft.openapi.yamlreader · fixed in 1.6.30, 3.10.0, 2.12.0
- CVE-2026-69522.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.diasymreader.native · fixed in 18.9.0-beta1.26405.2
- CVE-2026-48796CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folderNuGet · cefsharp.common · fixed in 148.0.90
- CVE-2026-54570AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point BypassNuGet · anglesharp · fixed in 1.5.0
- CVE-2026-48798SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP FilenamesNuGet · ssh.net · fixed in 2026.0.0
- CVE-2026-73851Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)NuGet · microsoft.openapi.kiota · fixed in 1.34.0, 1.29.1
- CVE-2026-74795Scriban before 6.6.0 Denial of Service via Uncontrolled RecursionNuGet · scriban, scriban.signed · fixed in 6.6.0
- CVE-2026-74794Scriban before 6.6.0 Denial of Service via Infinite RecursionNuGet · scriban, scriban.signed · fixed in 6.6.0
- CVE-2026-74792Scriban before 7.0.0 Stack Overflow via nested array initializersNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include CacheNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74790Scriban before 7.0.0 MemberFilter Bypass via TemplateContext CacheNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in OperationsNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_rightNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74787Scriban before 7.0.0 Uncontrolled Recursion via object.to_jsonNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74786Scriban before 7.0.0 Denial of Service via Unbounded Template OutputNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74785Scriban before 7.0.0 Denial of Service via Unbounded Resource ConsumptionNuGet · scriban, scriban.signed · fixed in 7.0.0
- CVE-2026-74784Scriban before 7.2.0 Denial of Service via array.insert_atNuGet · scriban, scriban.signed · fixed in 7.2.0
- CVE-2026-74783Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of ServiceNuGet · scriban, scriban.signed · fixed in 7.2.1
- CVE-2026-73062Scriban 3.0.0 through 7.2.0 Denial of Service via Array MultiplicationNuGet · scriban, scriban.signed · fixed in 7.2.1
- CVE-2026-73061Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorNuGet · scriban · fixed in 7.2.2
- GHSA-JWJP-4649-V8JPSIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsingNuGet · sipsorcery · fixed in 10.0.14