Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-61863ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61862ImageMagick before 7.1.2-26 Information Disclosure via identifyNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61860ImageMagick before 7.1.2-26 Use-After-Free via freetypeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61859ImageMagick before 7.1.2-26 Policy Bypass via script operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61464ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-56375ImageMagick - Memory Leak in ASHLAR Coder Action FailureNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.11.1
- CVE-2026-50659.NET Spoofing VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50651.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50650.NET Framework Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50648.NET Framework Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50646.NET Framework Remote Code Execution VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50528.NET Security Feature Bypass VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50527.NET Framework Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50526.NET Tampering VulnerabilityNuGet · microsoft.net.build.containers · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-50525.NET Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-50524.NET Framework Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-47304.NET Security Feature Bypass VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.10, 9.0.18, 8.0.4
- CVE-2026-47303ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.authentication.negotiate · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-47302.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +11 · fixed in 10.0.10, 9.0.18, 8.0.29 and more
- CVE-2026-47300ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.authentication.negotiate · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-57108.NET Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +6 · fixed in 10.0.10, 9.0.18, 8.0.29
- CVE-2026-56170ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 10.0.6, 9.0.15, 8.0.26
- CVE-2026-61870ImageMagick before 7.1.2-26 Memory Leak via VIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61861ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaptionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61858ImageMagick before 7.1.2-26 Policy Bypass via APNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61857ImageMagick before 7.1.2-26 Heap Use-After-Free via XMPNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61465ImageMagick before 7.1.2-26 Memory Allocation Policy BypassNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-56372ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify MethodNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56373ImageMagick - Use-After-Free Write in PDB DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56366ImageMagick - Memory Leak in META Reader APP1JPEG Error PathNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.11.1