Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-56379ImageMagick - Command Injection via SVG DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56376ImageMagick - Heap Use-After-Free in Meta CoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.3
- CVE-2026-56371ImageMagick - Memory Leak in TXT File Processing via Texture AttributeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad inputNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsNuGet · messagepack · fixed in 3.1.7
- CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodiesNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsNuGet · messagepack · fixed in 2.5.301, 3.1.7
- CVE-2026-56378ImageMagick - Heap Out-of-Bounds Read in PCD DecoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-56367ImageMagick - Heap Out-of-Bounds Read in PSB RLE DecodingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-50268Steeltoe: OAEP setting silently selects PKCS#1 v1.5 paddingNuGet · steeltoe.configuration.encryption · fixed in 4.2.0
- CVE-2026-50267Steeltoe: TLS private keys written to /tmp with default permissions, never deletedNuGet · steeltoe.configuration.abstractions · fixed in 4.2.0
- CVE-2026-50202Steeltoe's static JWKS cache shared across schemes and never invalidatedNuGet · steeltoe.security.authentication.cloudfoundrybase, steeltoe.security.authentication.jwtbearer +1 · fixed in 3.4.0, 4.2.0
- CVE-2026-50201Steeltoe's sensitive actuators (heapdump/env) only require Restricted permissionNuGet · steeltoe.management.endpoint, steeltoe.management.endpointbase · fixed in 4.2.0, 3.4.0
- CVE-2026-50200Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwordsNuGet · steeltoe.management.endpoint, steeltoe.management.endpointcore · fixed in 4.2.0, 3.4.0
- CVE-2026-50196Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetchNuGet · steeltoe.discovery.eureka · fixed in 4.2.0, 3.4.0
- CVE-2026-50194Steeltoe vulnerable to management-port isolation bypass via spoofed Host headerNuGet · steeltoe.management.endpoint, steeltoe.management.endpointcore · fixed in 4.2.0, 3.4.0
- CVE-2026-53465ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53464ImageMagick: Memory Leak in wand option parser when providing invalid argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53463ImageMagick: Null Pointer Dereference in distort operation when passing incorrect argumentsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53462ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent failsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53461ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loopNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-53460ImageMagick: Policy Bypass can trigger out-of-Memory conditionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0