Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54782CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validationNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54781CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforcedNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54784CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentialityNuGet · corewcf.primitives · fixed in 1.9.1
- CVE-2026-54774CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54783CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messagesNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54780CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54775CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.NuGet · corewcf.kafka · fixed in 1.8.1, 1.9.1
- CVE-2026-54778CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity ResolutionNuGet · corewcf.unixdomainsocket · fixed in 1.8.1, 1.9.1
- CVE-2026-54773CoreWCF: WS-Security signature substitution via document-wide Signature lookupNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54779CoreWCF: SAML token replay protection is inoperativeNuGet · corewcf.primitives · fixed in 1.8.1, 1.9.1
- CVE-2026-54772CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshakeNuGet · corewcf.netframingbase · fixed in 1.8.1, 1.9.1
- CVE-2026-54776CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgradeNuGet · corewcf.unixdomainsocket · fixed in 1.8.1, 1.9.1
- CVE-2026-54777CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instanceNuGet · corewcf.netnamedpipe · fixed in 1.8.1, 1.9.1
- CVE-2026-56374ImageMagick - Heap Buffer Overflow in FTXT Encoder via format ParameterNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56362ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata DesynchronizationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-55597ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55595ImageMagick: Infinite Loop in connected-components when providing invalid argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55594ImageMagick: Stack Overflow in MVG decoder due to missing depth check.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55510ImageMagick: Use-After-Free in crafted 8BIM when identifying an imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-53467ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchangedNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-53466ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflowNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-55628ImageMagick: Policy Bypass in concatenate operation due to missing checksNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-56369ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-56365ImageMagick - Memory Leak in PNG Encoder via MNG Image WritingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56364ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XMLNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.2
- CVE-2026-56363ImageMagick - Division by Zero in Binomial Kernel ProcessingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-56361ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology ProcessingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-49451Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsingNuGet · microsoft.openapi · fixed in 2.7.5, 3.5.4
- CVE-2026-56370ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components ArtifactNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.12.0
- CVE-2026-56368ImageMagick - Memory Leak in Raw Pixel Data CodersNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3