Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGsNuGet · tinymce · fixed in 7.1.0
- CVE-2026-44213OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configuredNuGet · opentelemetry.exporter.instana · fixed in 1.1.0
- CVE-2026-44788SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)NuGet · sharpcompress · fixed in 0.48.0
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirectNuGet · microsoft.kiota.abstractions · fixed in 1.22.0
- CVE-2026-44375Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowExceptionNuGet · nerdbank.messagepack · fixed in 1.1.62
- CVE-2026-44302Snappier: Infinite loop in SnappyStream decompression on malformed framed inputNuGet · snappier · fixed in 1.3.1
- CVE-2026-42191OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP ExporterNuGet · opentelemetry.exporter.opentelemetryprotocol · fixed in 1.15.3
- CVE-2026-42348OpAMP client reads unbounded HTTP response bodiesNuGet · opentelemetry.opamp.client · fixed in 0.2.0-alpha.1
- CVE-2026-42899ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-32175.NET Core Tampering VulnerabilityNuGet · microsoft.netcore.app.runtime.win-arm, microsoft.netcore.app.runtime.win-arm64 +2 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-35433.NET Elevation of Privilege VulnerabilityNuGet · microsoft.windowsdesktop.app.runtime.win-arm64, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 8.0.27, 9.0.16, 10.0.8
- CVE-2026-43937YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`NuGet · yafnet.core · fixed in 4.0.5
- CVE-2026-43938YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderNuGet · yafnet.core · fixed in 4.0.5, 3.2.12
- CVE-2026-43939YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersNuGet · yafnet.core · fixed in 4.0.5, 3.2.12
- CVE-2026-41511OpenMcdf has an Infinite loop DoS via crafted CFB directory cycleNuGet · openmcdf · fixed in 3.1.3
- CVE-2026-42241ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type WidthNuGet · parquetsharp · fixed in 23.0.0.1
- CVE-2026-41484OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response bodyNuGet · opentelemetry.exporter.onecollector · fixed in 1.15.1
- CVE-2026-41483Unbounded HTTP response body read in OpenTelemetry.Resources.AzureNuGet · opentelemetry.resources.azure · fixed in 1.15.1-beta.1
- CVE-2026-41310OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthNuGet · opentelemetry.exporter.zipkin · fixed in 1.15.3
- CVE-2026-41319MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgradeNuGet · mailkit · fixed in 4.16.0
- CVE-2026-41173Unbounded HTTP response body read in OpenTelemetry.Sampler.AWSNuGet · opentelemetry.resources.aws, opentelemetry.sampler.aws · fixed in 1.15.1, 0.1.0-alpha.8
- CVE-2026-41078OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathNuGet · opentelemetry.exporter.jaeger
- CVE-2026-40894OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersNuGet · opentelemetry.api, opentelemetry.extensions.propagators · fixed in 1.15.3
- CVE-2026-40891OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingNuGet · opentelemetry.exporter.opentelemetryprotocol · fixed in 1.15.3
- CVE-2026-40182OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesNuGet · opentelemetry.exporter.opentelemetryprotocol · fixed in 1.15.2
- CVE-2026-41134Kiota: Code Generation Literal InjectionNuGet · microsoft.openapi.kiota, microsoft.openapi.kiota.builder · fixed in 1.31.1, 1.29.1
- CVE-2026-40372ASP.NET Core Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.dataprotection · fixed in 10.0.7
- CVE-2026-40324Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL DocumentsNuGet · hotchocolate.language · fixed in 12.22.7, 13.9.16, 14.3.1 and more
- CVE-2026-40321DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploadNuGet · dotnetnuke.core · fixed in 10.2.2
- CVE-2026-40306DNN has same HostGUID for all new installsNuGet · dotnetnuke.core · fixed in 10.2.2