Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-123815pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)PyPI · pyload-ng
- CVE-2026-123814pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostPyPI · pyload-ng
- CVE-2026-123813pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionPyPI · pyload-ng
- CVE-2026-90436Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionNameMaven · axis:axis, org.apache.axis:axis
- GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/arGo · github.com/blakesmith/ar
- GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/samlGo · github.com/crewjam/saml
- GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-goGo · github.com/mark3labs/mcp-go
- RUSTSEC-2026-0449`ocipkg` is unmaintainedcrates.io · ocipkg
- CVE-2026-100302Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingMaven · org.apache.zookeeper:zookeeper
- CVE-2026-115448Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100300Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply…Maven · org.apache.zookeeper:zookeeper
- CVE-2026-100252Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization IDMaven · org.apache.zookeeper:zookeeper
- CVE-2026-100235Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationMaven · org.apache.zookeeper:zookeeper
- CVE-2026-103582Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)NuGet · apache.nms.activemq
- RUSTSEC-2026-0440`astral-tokio-tar` is unmaintainedcrates.io · astral-tokio-tar
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipMaven · org.apache.oozie:oozie-main
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsingMaven · org.apache.jclouds:jclouds-core
- CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasmPyPI · pybddisasm
- CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasmPyPI · pybddisasm
- CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasmPyPI · pybddisasm
- CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasmPyPI · pybddisasm
- CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events searchMaven · org.apache.syncope.core:syncope-core-persistence-jpa
- CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassMaven · org.apache.syncope.core:syncope-core-spring
- CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm updateMaven · org.apache.syncope.core.idrepo:syncope-core-idrepo-logic
- CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service updateMaven · org.apache.syncope.core.am:syncope-core-am-logic
- CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expressionMaven · org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupMaven · org.apache.wicket:wicket-core
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesMaven · org.apache.wicket:wicket-core