Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredMaven · org.apache.kafka:kafka
- CVE-2026-110748Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 filesMaven · org.apache.sis:sis-metadata
- CVE-2026-54711PGHoard: Password written to debug logPyPI · pghoard
- CVE-2026-106763An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and…npm · @justice8096/sagemath-mcp-server
- CVE-2026-106764An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.npm · @rog0x/mcp-git-tools
- CVE-2026-106765An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.npm · @rog0x/mcp-docker-tools
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionHex · esaml
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionHex · esaml
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionHex · esaml
- CVE-2020-37289Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return ValuesPyPI · vyper
- CVE-2026-113712Cachet has Stored XSS in Incident ComponentPackagist · cachethq/cachet
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost OriginsGo · code.vikunja.io/api
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project PermissionsGo · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via WebhooksGo · code.vikunja.io/api
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session RevocationGo · code.vikunja.io/api
- CVE-2026-54697ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsingMaven · org.connectbot.sshlib:sshlib
- CVE-2026-54700ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocationMaven · org.connectbot.sshlib:sshlib
- CVE-2026-46438wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entryPyPI · wger
- CVE-2026-46437wger: API credentials remain valid after logout/password changePyPI · wger
- CVE-2026-46434wger: Trainer Privilege Escalation - Improper Privilege ManagementPyPI · wger
- CVE-2026-45161wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingPyPI · wger
- CVE-2026-43976wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)PyPI · wger
- CVE-2026-106454Twisted: IMAP wildcardToRegexp() ReDoSPyPI · twisted
- CVE-2026-95105Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingHex · cloak
- RUSTSEC-2026-0444`astral-tl` is unmaintainedcrates.io · astral-tl
- CVE-2026-54049Sakai Conversations has a Stored XSS IssueMaven · org.sakaiproject.conversations:sakai-conversations-impl, org.sakaiproject.kernel:sakai-kernel-impl +1
- RUSTSEC-2026-0441`pin-utils` is unmaintainedcrates.io · pin-utils
- CVE-2026-103001PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusePyPI · pyjwt
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriGo · github.com/nezhahq/nezha
- CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context HintGo · github.com/cloudreve/cloudreve, github.com/cloudreve/cloudreve/v3 +1