Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49219ImageMagick: Policy Bypass can read disallowed filesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-49218ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48994ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systemsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48734ImageMagick: Stack Overflow in MVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48733ImageMagick: Infinite Loop in subimage-search with crafted imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-48724ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth ditheringNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.14.0
- CVE-2026-47166ImageMagick: Heap Buffer Over-Read in distributed pixel cache serverNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-47165ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication modelNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-46693ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijackingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-46692ImageMagick: Heap Buffer Over-Write in distributed pixel cache serverNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-46559ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46557ImageMagick: Stack overflow in fx operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46521ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compressionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46520ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45664ImageMagick: Policy Bypass in MNG coder couldNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46522ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45624ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45359ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top defineNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45358ImageMagick: Out-of-Bounds Read of a single byte in meta encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-42326ImageMagick: Heap Buffer Over-Read in IPTC encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-45031ImageMagick: Policy Bypass in PSD decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46523ImageMagick: Use-After-Free in MSL decoder.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.13.1
- CVE-2026-46609Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialogNuGet · umbraco.cms · fixed in 17.4.0
- CVE-2026-46616Umbraco.Cms: Open Redirect Vulnerability in Surface ControllersNuGet · umbraco.cms · fixed in 13.14.0, 17.4.0
- CVE-2026-45591ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-x64, microsoft.aspnetcore.app.runtime.osx-arm64 +2 · fixed in 8.0.28, 9.0.17, 10.0.9
- CVE-2026-45491.NET Tampering VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-x64, microsoft.netcore.app.runtime.osx-arm64 +1 · fixed in 8.0.28, 9.0.17, 10.0.9
- CVE-2026-45288Marten has an SQL injection vulnerability in its full-text search regConfig parameterNuGet · marten · fixed in 8.37.0
- CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsNuGet · tinymce · fixed in 7.9.3, 8.5.1
- CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectionNuGet · tinymce · fixed in 7.9.3, 8.5.1
- CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributesNuGet · tinymce · fixed in 7.9.3, 8.5.1