Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-62898Microsoft QUIC Information Disclosure VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm64, microsoft.netcore.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-70354.NET Core Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62886.NET Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62902.NET Information Disclosure VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62897.NET Framework Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.11, 9.0.19, 8.0.30
- CVE-2026-62946ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.15.0
- CVE-2026-62363ImageMagick: Heap Buffer Over-Write in fx operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-62343ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-66011ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI OptionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-45785OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycleNuGet · openmcdf · fixed in 3.1.4
- CVE-2026-55254NCalc: Denial of Service via Unbounded and Non-Terminating Factorial EvaluationNuGet · ncalc.core, ncalcsync · fixed in 6.1.1
- CVE-2026-50273Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSNuGet · datadog.trace, datadog.trace.opentracing · fixed in 3.43.0
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference ExpansionNuGet · prompty.core · fixed in 2.0.0-beta.2
- CVE-2026-59867Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59866Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59864Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59865Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`NuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59863Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.5, 1.29.1
- CVE-2026-59859Kiota: Code Generation Literal Injection in the PHP GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.4, 1.29.1
- CVE-2026-59862Kiota: Code Generation Literal Injection in the Python GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.0, 1.29.1
- CVE-2026-59861Kiota: Code Generation Literal Injection in Kiota Ruby GeneratorNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.0, 1.29.1
- CVE-2026-59860Kiota: XML Doc-Comment Newline Breakout Code InjectionNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.32.3, 1.29.1
- CVE-2026-61872ImageMagick before 7.1.2-26 Memory Leak via TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61871ImageMagick before 7.1.2-26 Memory Leak in ICON decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61869ImageMagick before 7.1.2-26 Memory Leak in MIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61868ImageMagick before 7.1.2-26 Memory Leak in YUV DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61867ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61866ImageMagick before 7.1.2-26 Memory Leak in JNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61865ImageMagick before 7.1.2-26 Memory Leak in Hough LinesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61864ImageMagick before 7.1.2-26 Memory Leak in Log ColorspaceNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0