Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsMaven · org.springframework:spring-expression
- CVE-2026-41847Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLMaven · org.springframework:spring-webflux
- CVE-2026-11481yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11479yoanbernabeu grepai Qdrant Backend chunker.go weak hashGo · github.com/yoanbernabeu/grepai
- CVE-2026-11477hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirectMaven · org.hswebframework.web:hsweb-authorization-oauth2
- CVE-2026-11470hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversalMaven · org.hswebframework.web:hsweb-system-file
- CVE-2026-11466zilliztech deep-searcher collection_router.py CollectionRouter.invoke access controlPyPI · deepsearcher
- CVE-2026-11465songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic errorGo · github.com/songquanpeng/one-api
- CVE-2026-45758Malicious code in guardrails-ai 0.10.1 (supply chain compromise)PyPI · guardrails-ai
- CVE-2026-10732All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archivnpm · decompress
- CVE-2026-11312bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexityPyPI · infinistore
- CVE-2026-37737sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.maPyPI · sanic-cors
- CVE-2026-41249CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` ConfigurationPackagist · coreshop/core-shop
- CVE-2026-10813LMCache KV Cache utils.py hex_hash_to_int16 weak hashPyPI · lmcache
- CVE-2026-10812zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hashPyPI · gptcache
- CVE-2026-10802keystonejs keystone GraphQL API Endpoint output-field.ts resource consumptionnpm · @keystone-6/core
- CVE-2026-10801modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hashPyPI · ms-swift
- CVE-2026-44393An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0.PyPI · oslo-messaging
- CVE-2026-10775sgl-project SGLang Cache data_hash denial of servicePyPI · sglang
- CVE-2026-10766mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hashPyPI · mlrun
- CVE-2026-6657CORS Origin Validation Bypass in jupyter-serverPyPI · jupyter-server
- CVE-2026-10690wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgerynpm · @wonderwhy-er/desktop-commander
- CVE-2026-49144BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handlernpm · browserstack-runner
- CVE-2026-49143BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handlernpm · browserstack-runner
- CVE-2026-10566FoundationAgents MetaGPT schema.py Message.check_instruct_content deserializationPyPI · metagpt
- CVE-2026-10300SGLang Inference HTTP Endpoint lora_manager.py assertionPyPI · sglang
- CVE-2026-44211Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerabilitynpm · cline
- CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersMaven · org.apache.solr:solr-core
- CVE-2026-10224NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumptionPyPI · hermes-agent
- CVE-2026-10221NousResearch hermes-agent run_agent.py _compress_context injectionPyPI · hermes-agent