Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-102904JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsPyPI · jupyterlab · fixed in 4.6.4, 4.5.11
- CVE-2026-102831JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardPyPI · jupyterlab, jupyterlite +2 · fixed in 4.6.4, 4.5.11, 0.8.4 and more
- CVE-2026-102830JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)PyPI · jupyterlab, jupyterlite-core · fixed in 4.6.4, 4.5.11, 0.8.4
- CVE-2026-97689urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-97688urllib3: Chunked Deflate streaming can enter an infinite loopPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-97687urllib3: HTTPS proxy TLS configuration may be ignored or overriddenPyPI · urllib3 · fixed in 2.8.0
- CVE-2026-102598Werkzeug safe_join() allows Windows special device namesPyPI · werkzeug · fixed in 3.1.9
- CVE-2026-81930Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainPyPI · apache-airflow-providers-snowflake · fixed in 6.18.0
- CVE-2026-81914Apache Airflow Google provider: Google Drive query injection via unescaped file and folder namesPyPI · apache-airflow-providers-google · fixed in 22.6.0
- CVE-2026-102265PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102275PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionPyPI · pyjwt · fixed in 2.15.0
- CVE-2026-102274PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102273PyJWT accepts public JWK containers as HMAC secretsPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102272PyJWT BOM BypassPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102271PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102270PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.PyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102269PyJWT: Non-canonical signature segments enable raw-token revocation bypassPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102268PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102267PyJWT: PyJWKClient follows redirects when fetching JWKSPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-102266PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationPyPI · pyjwt · fixed in 2.14.0
- CVE-2026-101918PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)PyPI · pyjwt · fixed in 2.15.0
- CVE-2026-101917PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)PyPI · pyjwt · fixed in 2.14.0
- CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerabilityPyPI · authlib · fixed in 1.9.0
- CVE-2026-100846MONAI before 1.5.2 Remote Code Execution via Pickle DeserializationPyPI · monai · fixed in 1.6.0, 1.5.2
- CVE-2026-100845MONAI before 1.6.0 Remote Code Execution via NumpyReaderPyPI · monai · fixed in 1.6.0
- CVE-2026-100844MONAI before 1.6.0 OS Command Injection via dataset_name_or_idPyPI · monai · fixed in 1.6.0
- CVE-2026-100843MONAI before 1.6.0 Remote Code Execution via algo_from_picklePyPI · monai · fixed in 1.6.0
- CVE-2026-100842MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute ChainsPyPI · monai · fixed in 1.6.1rc0
- CVE-2026-100841MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle CachePyPI · monai
- CVE-2026-100840MONAI through 1.6.0 Remote Code Execution via bundle configurationPyPI · monai · fixed in 1.6.1rc0