Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-40305DNN has Force Friend Request AcceptanceNuGet · dotnetnuke.core · fixed in 10.2.2
- CVE-2026-32203.NET and Visual Studio Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-26171.NET Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-33116.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityNuGet · system.security.cryptography.xml · fixed in 10.0.6, 9.0.15, 8.0.3
- CVE-2026-32178.NET Spoofing VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 10.0.6, 9.0.15, 8.0.26
- CVE-2026-40312ImageMagick: Off-by-One in MSL decoder could result in crashNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-40311ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing valuesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +14 · fixed in 14.12.0
- CVE-2026-40310ImageMagick: Heap out-of-bounds write in JP2 encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +14 · fixed in 14.12.0
- CVE-2026-40183ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit floatNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-40169ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encodersNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-34238ImageMagick: Integer overflow in despeckle operation causes heap buffer overflow on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.12.0
- CVE-2026-33908ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33905ImageMagick has an Out-of-Bounds read via -sample operationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33902ImageMagick: Stack Overflow via Recursive FX Expression ParsingNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33901ImageMagick has a Heap Buffer Overflow via MVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-33900ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit buildsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.12.0
- CVE-2026-33899ImageMagick: Heap BufferOverflow write of single zero byte when parsing XMLNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.12.0
- CVE-2026-40021Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersNuGet · log4net · fixed in 3.3.0
- CVE-2026-39959Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of serviceNuGet · tmds.dbus, tmds.dbus.protocol · fixed in 0.92.0, 0.21.3
- CVE-2026-33536ImageMagick has an Out-of-bounds Write via InterpretImageFilenameNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.11.1
- CVE-2026-33535ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interactionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.11.1
- CVE-2026-32933AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled RecursionNuGet · automapper · fixed in 16.1.1, 15.1.1
- CVE-2026-32636ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crashNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.11.0
- CVE-2026-31853ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-31834Umbraco Affected by Vertical Privilege Escalation via Missing Authorization ChecksNuGet · umbraco.cms · fixed in 16.5.1, 17.2.2
- CVE-2026-31833Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute FilteringNuGet · umbraco.cms · fixed in 16.5.1, 17.2.2
- CVE-2026-31832Umbraco Backoffice API Allows Unauthorized Modification of Domain DataNuGet · umbraco.cms · fixed in 16.5.1, 17.2.2
- CVE-2026-26130ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 8.0.25, 9.0.14, 10.0.4
- CVE-2026-26118Azure MCP Server Tools Elevation of Privilege VulnerabilityNuGet · azure.mcp · fixed in 2.0.0-beta.17, 1.0.2
- CVE-2026-26127.NET Denial of Service VulnerabilityNuGet · microsoft.bcl.memory, microsoft.netcore.app.runtime.linux-arm +11 · fixed in 9.0.14, 10.0.4