Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- RUSTSEC-2026-0431Unbounded memory allocation in `evtx` parsing a `.wevtcache` filecrates.io · evtx · fixed in 0.15.1
- CVE-2026-120135Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by defaultMaven · org.apache.thrift:libthrift · fixed in 0.24.0
- CVE-2026-118636Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderMaven · org.apache.mina:mina-core
- RUSTSEC-2026-0432`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)crates.io · codeq · fixed in 0.6.3
- RUSTSEC-2026-0434`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)crates.io · ant-releases
- CVE-2026-117656Unverified Sign in with Apple callback parameter can override verified ID token claimsHex · assent · fixed in 0.3.2
- GHSA-4XM8-RG9H-JHQ2Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionnpm · @signalk/resources-provider, signalk-server · fixed in 1.5.3, 2.34.0
- GHSA-2WRX-84QJ-4PCGanacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSGo · github.com/anacrolix/torrent · fixed in 1.61.1-0.20260911233437-76452a2c8a2f
- CVE-2026-63414Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsRubyGems · shopify_app · fixed in 23.0.3
- CVE-2026-63224OpenRemote has authenticated SQL injection in crosstab datapoint exportsMaven · io.openremote:openremote-manager · fixed in 1.26.0
- CVE-2026-118938Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysisPyPI · fickling
- CVE-2026-16760Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablesPyPI · fickling
- CVE-2026-117645Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1Hex · phoenix_html · fixed in 3.3.5, 4.4.0
- CVE-2026-62847Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)NuGet · metalama.framework, metalama.tool · fixed in 2026.1.19, 2025.1.18, 2026.0.25
- CVE-2026-117666ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundaryHex · ssl_verify_fun · fixed in 1.1.8
- CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionNuGet · metalama.framework · fixed in 2026.1.19, 2025.1.18, 2026.0.25
- CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resourcesnpm · filecoin-pin · fixed in 1.1.1
- CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735Go · github.com/basekick-labs/arc · fixed in 0.0.0-20260610131716-5dc8f53b70a3
- CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyGo · github.com/osac-project/osac-operator · fixed in 0.0.4
- CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injectionGo · github.com/mtzanidakis/praktor · fixed in 0.9.1
- CVE-2026-61586Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)Maven · eu.copernik:copernik-xml-factory · fixed in 0.1.2
- CVE-2026-59978AdminNeo: version-cache array injection causes persistent denial of servicePackagist · adminneo-org/adminneo · fixed in 5.5.0
- CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumptionRubyGems · crass · fixed in 1.0.7
- CVE-2026-61847Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorRubyGems · crass · fixed in 1.0.7
- CVE-2026-61846Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageRubyGems · crass · fixed in 1.0.7
- CVE-2026-46560OpenAM Authentication Bypass via RADIUS SpoofingMaven · org.openidentityplatform.openam:openam-radius · fixed in 16.1.1
- CVE-2026-62264PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYnpm · @sylphx/pdf-reader-mcp · fixed in 3.0.1
- CVE-2026-62160Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGo · github.com/daptin/daptin
- CVE-2026-119978Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStorenpm · flowise, flowise-components · fixed in 3.1.3
- CVE-2026-119298croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receiveGo · github.com/schollz/croc, github.com/schollz/croc/v10 +4 · fixed in 11.5.2