Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-111211Potential log injection via unescaped geometry form valuesPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file uploadPyPI · django · fixed in 6.1.3, 6.0.10, 5.2.19
- CVE-2026-121564Silent loss of messages when merging overlapping chat exports in whatstkPyPI · whatstk · fixed in 0.9.0
- CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasmPyPI · pybddisasm
- CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasmPyPI · pybddisasm
- CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasmPyPI · pybddisasm
- CVE-2026-120492Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urlsPyPI · chainlit · fixed in 2.12.0
- CVE-2026-118938Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysisPyPI · fickling
- CVE-2026-16760Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablesPyPI · fickling
- CVE-2026-119286GraphQL-core: Denial of service via memory leak in aborted validationsPyPI · graphql-core · fixed in 3.3.1
- CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionPyPI · joserfc · fixed in 1.7.6
- CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionPyPI · joserfc · fixed in 1.7.5
- CVE-2026-119209pypdf: Possible large memory usage when parsing cross-reference streamsPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119208pypdf: Possible long runtimes/large memory usage for encrypted PDF filesPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119207pypdf: Possible large memory usage for exceptions in strict modePyPI · pypdf · fixed in 6.21.3
- CVE-2026-119206pypdf: Possible long runtimes when retrieving page labelsPyPI · pypdf · fixed in 6.21.3
- CVE-2026-119205pypdf: Possible infinite loop when cloning dictionariesPyPI · pypdf · fixed in 6.21.4
- CVE-2026-119204pypdf: Possible large memory usage when parsing page treePyPI · pypdf · fixed in 6.21.4
- CVE-2026-119203pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer searchPyPI · pypdf · fixed in 6.21.4
- CVE-2026-119197pyasn1: Quadratic-complexity denial of service in binary REAL decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119196pyasn1: Quadratic CPU consumption in constructed BIT STRING decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119195pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingPyPI · pyasn1 · fixed in 0.6.5
- CVE-2026-119194pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingPyPI · pyasn1 · fixed in 0.6.5
- GHSA-VPP8-G58W-M8MPTwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream ResetPyPI · twisted · fixed in 26.10.0rc1
- CVE-2026-118669OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientPyPI · oauthlib · fixed in 4.0.0
- CVE-2026-118668LangGraph JavaScript custom authentication may permit cross-user Store accessPyPI · langgraph-api · fixed in 0.15.0
- CVE-2026-118667LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsPyPI · langgraph, langgraph-sdk · fixed in 1.2.14, 0.4.6