Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-75508GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitPyPI · graphql-core · fixed in 3.2.12, 3.3.0rc1
- CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiPyPI · opentelemetry-api · fixed in 1.45.1
- CVE-2026-114510Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from…PyPI · flexible-graphrag · fixed in 0.8.2
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderPyPI · brotli, brotlicffi · fixed in 1.2.1, 1.2.1.0
- CVE-2026-115324mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector StorePyPI · mem0ai · fixed in 1.0.8
- CVE-2026-114501Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1PyPI · pillow · fixed in 13.0.0
- CVE-2026-96639Pillow multi-frame loaders can reuse stale native image storage after mode transitionsPyPI · pillow · fixed in 13.0.0
- CVE-2026-96636Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)PyPI · pillow · fixed in 13.0.0
- CVE-2026-96640Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPyPI · pillow · fixed in 13.0.0
- CVE-2026-96637Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSPyPI · pillow · fixed in 13.0.0
- CVE-2026-96778Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPyPI · pillow · fixed in 13.0.0
- CVE-2026-96643Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timePyPI · pillow · fixed in 13.0.0
- CVE-2026-96644Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)PyPI · pillow · fixed in 13.0.0
- CVE-2026-96641Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisePyPI · pillow · fixed in 13.0.0
- CVE-2026-96642Pillow: TarIO negative size field causes infinite CPU-spin loopPyPI · pillow · fixed in 13.0.0
- CVE-2026-96638Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modePyPI · pillow · fixed in 13.0.0
- CVE-2026-114145GitPython validates a submodule's ".git" path only after cloning into it (RCE)PyPI · gitpython · fixed in 3.2.1
- CVE-2026-114140nbconvert: File write via path traversal in cell output filenamesPyPI · nbconvert · fixed in 7.17.2
- CVE-2026-114138Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationPyPI · djangorestframework · fixed in 3.18.2
- CVE-2026-114137Django REST framework: TokenProxy.delete() reports success and revokes nothingPyPI · djangorestframework · fixed in 3.18.2
- CVE-2026-114136Django REST framework: JSONParser applies an attacker-named codec to the request streamPyPI · djangorestframework · fixed in 3.18.2
- CVE-2026-114135Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationPyPI · jupyter-server · fixed in 2.6.0
- CVE-2026-113795pypdf: Possible large memory usage for streams with multiple filtersPyPI · pypdf · fixed in 6.20.0
- CVE-2026-113794pypdf: Possible infinite loop when hitting EOF in standard xref tablePyPI · pypdf · fixed in 6.20.0
- CVE-2026-113793pypdf: Possible infinite loop when removing tree itemsPyPI · pypdf · fixed in 6.20.1
- CVE-2026-113792pypdf: Possible infinite loop in PdfWriter.find_outline_itemPyPI · pypdf · fixed in 6.20.1
- CVE-2026-113791pypdf: Possible large memory usage when parsing content streamsPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113790pypdf: Possible large memory usage when parsing arrays and dictionariesPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113789pypdf: Possible long runtimes/large memory usage when retrieving form fieldsPyPI · pypdf · fixed in 6.21.0
- CVE-2026-113786pypdf: Unvalidated JPEG image data loadingPyPI · pypdf · fixed in 6.21.1