Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42087OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data BaseRubyGems · openc3 · fixed in 7.0.0-rc3
- CVE-2026-42086OpenC3 COSMOS: Self-XSS in the Command SenderRubyGems · openc3 · fixed in 7.0.0
- CVE-2026-42085OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenamesRubyGems · openc3 · fixed in 6.10.5, 7.0.0-rc3
- CVE-2026-42084OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceRubyGems · openc3 · fixed in 6.10.5, 7.0.0-rc3
- CVE-2026-41316ERB has an @_init deserialization guard bypass via def_module / def_method / def_classRubyGems · erb · fixed in 4.0.3.1, 4.0.4.1, 6.0.1.1 and more
- CVE-2026-41146facil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionRubyGems · iodine
- CVE-2026-40869Decidim amendments can be accepted or rejected by anyoneRubyGems · decidim-core · fixed in 0.31.1, 0.30.5
- CVE-2026-27820zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruptionRubyGems · zlib · fixed in 3.2.3, 3.1.2, 3.0.1
- CVE-2026-23891Decidim has a Cross-site scripting (XSS) vulnerability via user name fieldRubyGems · decidim-core · fixed in 0.31.1, 0.30.5
- CVE-2026-40070bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)RubyGems · bsv-sdk, bsv-wallet · fixed in 0.8.2, 0.3.4
- CVE-2026-40069bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcastsRubyGems · bsv-sdk · fixed in 0.8.2
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationRubyGems · rack-session · fixed in 2.1.2
- CVE-2026-35611Addressable has a Regular Expression Denial of Service in Addressable templatesRubyGems · addressable · fixed in 2.9.0
- CVE-2026-35201Discount has an Out-of-bounds Read in rdiscountRubyGems · rdiscount · fixed in 2.2.7.4
- CVE-2026-26962Rack: Header injection in multipart requestsRubyGems · rack · fixed in 3.2.6
- CVE-2026-34835Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.RubyGems · rack · fixed in 3.1.21, 3.2.6
- CVE-2026-34827Rack: Algorithmic-Complexity DoS in Rack::Multipart::ParserRubyGems · rack · fixed in 3.1.21, 3.2.6
- CVE-2026-32762Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingRubyGems · rack · fixed in 3.1.21, 3.2.6
- CVE-2026-34830Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginxRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34829Rack: Denial of Service via Unbounded Multipart File Upload Without Content-LengthRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34826Rack: Unbounded Range Count in get_byte_ranges Enables DoSRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded pathsRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix MatchingRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34763Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolationRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34831Rack: Content-Length mismatch in Rack::Files error responsesRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-26961Rack: Multipart Boundary Parsing Ambiguity allowing WAF BypassRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34230Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerRubyGems · rack · fixed in 2.2.23, 3.1.21, 3.2.6
- CVE-2026-34060Ruby LSP has arbitrary code execution through branch settingRubyGems · ruby-lsp · fixed in 0.26.9
- CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID ReplayRubyGems · mcp · fixed in 0.9.2
- CVE-2026-33658Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requestsRubyGems · activestorage · fixed in 8.1.2.1, 8.0.4.1, 7.2.3.1