Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-84381HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxiesPyPI · httpcore2, httpx2 · fixed in 2.10.0
- CVE-2026-84380HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generatedPyPI · httpx2 · fixed in 2.11.0
- CVE-2026-84379HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersPyPI · httpx2 · fixed in 2.11.0
- CVE-2026-84378HTTPX2: Quadratic SSE line buffering can cause CPU denial of servicePyPI · httpx2 · fixed in 2.10.0
- CVE-2026-84377LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersPyPI · litellm · fixed in 1.88.6, 1.89.7, 1.90.7 and more
- CVE-2026-32773Apache Spark: XSS Vulnerability in Spark Web 3.5.4PyPI · pyspark · fixed in 3.5.8
- CVE-2026-84366Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by defaultPyPI · scrapy · fixed in 2.17.0, 2.17
- CVE-2026-84311pypdf: Possible long runtimes/large memory usage when extracting XForm objectsPyPI · pypdf · fixed in 6.16.1
- CVE-2026-84310pypdf: Possible long runtimes/large memory usage when retrieving outlinesPyPI · pypdf · fixed in 6.16.1
- CVE-2026-84309pypdf: Possible infinite loop for TreeObject.insert_childPyPI · pypdf · fixed in 6.16.0
- CVE-2026-84305sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumptionPyPI · sqlparse · fixed in 0.6.0
- CVE-2026-80047Hugging Face Transformers library writes remote code to disk prior to consent checkPyPI · transformers
- CVE-2026-82398pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespacePyPI · pypdf · fixed in 6.15.0
- CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopPyPI · tornado · fixed in 6.5.8
- CVE-2026-55247plone.app.event: Denial of service via iCalendar importPyPI · plone-app-event · fixed in 5.2.4, 6.0.1
- CVE-2026-55520Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matchingPyPI · protego · fixed in 0.6.2
- CVE-2026-55248plone.app.portlets: Denial of service via RSS feed portletPyPI · plone-app-portlets · fixed in 5.0.8, 6.0.4, 7.0.2
- CVE-2026-55485Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.PyPI · piccolo-admin · fixed in 1.14.0
- CVE-2026-55509WsgiDAV: Blind SQL injection in the MySQL providerPyPI · wsgidav · fixed in 4.3.5
- CVE-2026-79720Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-79719Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-79718Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perPyPI · netron · fixed in 9.1.3
- CVE-2026-81727NLTK before 3.10.3 Hardlink File Overwrite via downloaderPyPI · nltk · fixed in 3.10.3
- CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIsPyPI · nltk · fixed in 3.10.3
- CVE-2026-81725NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReaderPyPI · nltk · fixed in 3.10.3
- CVE-2026-81724NLTK before 3.10.3 Denial of Service via Uncontrolled RecursionPyPI · nltk · fixed in 3.10.3
- CVE-2026-81723NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusViewPyPI · nltk · fixed in 3.10.3
- CVE-2026-81722nltk PorterStemmer before 3.10.3 Quadratic-time DoSPyPI · nltk · fixed in 3.10.3
- CVE-2026-81721openssl_encrypt before 1.4.9 Denial of Service via KDFPyPI · openssl-encrypt · fixed in 1.4.9
- CVE-2026-81720openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2PyPI · openssl-encrypt · fixed in 1.4.9