Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-46374SQLFluff: Uncontrolled Resource Consumption in ParserPyPI · sqlfluff · fixed in 4.2.0
- CVE-2026-46373SQLFluff: Recursive Stack Overflow in ParserPyPI · sqlfluff · fixed in 4.1.0
- CVE-2026-52902Awxkit: path traversal via yaml !include directivePyPI · awxkit
- CVE-2026-49818Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object namesPyPI · apache-airflow-providers-samba · fixed in 4.12.6
- CVE-2026-44541Fides: DOM-based XSS vulnerability in fides.js via fides_description overridePyPI · ethyca-fides · fixed in 2.84.5
- CVE-2026-46486Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processingPyPI · mvt · fixed in 2026.5.12
- CVE-2026-11529designcomputer mysql-mcp-server mysql URI server.py read_resource sql injectionPyPI · mysql-mcp-server · fixed in 0.3.0
- CVE-2026-11466zilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlPyPI · deepsearcher
- CVE-2026-45409Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixPyPI · idna · fixed in 3.15
- CVE-2026-45758Malicious code in guardrails-ai 0.10.1 (supply chain compromise)PyPI · guardrails-ai
- CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionPyPI · ansible-core · fixed in 2.16.19rc1, 2.18.18rc1, 2.19.11rc1 and more
- CVE-2026-11312bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexityPyPI · infinistore
- CVE-2026-37737sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.maPyPI · sanic-cors
- CVE-2026-50589In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JPyPI · ironic · fixed in 37.0.0
- CVE-2026-50266In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set devicPyPI · neutron · fixed in 28.0.1
- CVE-2026-10813LMCache KV Cache utils.py hex_hash_to_int16 weak hashPyPI · lmcache
- CVE-2026-10812zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hashPyPI · gptcache
- CVE-2026-47707Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationPyPI · strawberry-graphql · fixed in 0.315.7
- CVE-2026-45739Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLsPyPI · strawberry-graphql · fixed in 0.315.4
- CVE-2026-47706Strawberry GraphQL has a Circular Fragment Reference DOSPyPI · strawberry-graphql · fixed in 0.315.7
- CVE-2026-10804Streamlit Palette hashing.py weak hashPyPI · streamlit · fixed in 1.53.1
- CVE-2026-10803MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hashPyPI · mlflow · fixed in 3.10.1
- CVE-2026-10801modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hashPyPI · ms-swift
- CVE-2026-41283OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed.PyPI · mistral · fixed in 20.1.1
- CVE-2026-44393An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0.PyPI · oslo-messaging
- CVE-2026-48681OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.PyPI · ironic · fixed in 26.1.7, 29.0.6, 32.0.2 and more
- CVE-2026-10783gradio-app gradio Audio Cache Key save_audio_to_cache weak hashPyPI · gradio · fixed in 6.15.1
- CVE-2026-10775sgl-project SGLang Cache data_hash denial of servicePyPI · sglang
- CVE-2026-10766mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hashPyPI · mlrun
- CVE-2026-6657CORS Origin Validation Bypass in jupyter-serverPyPI · jupyter-server