Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-76846Grav before 2.0.16 Information Disclosure via Twig SandboxPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-76839Grav before 2.0.16 Information Disclosure via offsetGetPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72702Grav CMS before 2.0.16 Origin Validation Bypass via RefererPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72701Grav CMS before 2.0.16 Timing Attack via verifyNoncePackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox BypassPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72697Grav CMS before 2.0.16 Path Traversal via media_directoryPackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-72695Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFilePackagist · getgrav/grav · fixed in 2.0.16
- CVE-2026-45404OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessGo · go.opentelemetry.io/otel/bridge/opentracing · fixed in 1.45.0
- CVE-2026-55468Wagtail: Improper restriction handling on Pages admin APIPyPI · wagtail · fixed in 7.0.9, 7.3.4, 7.4.3 and more
- CVE-2026-77634CakePHP: SmtpTransport vulnerable to CRLF header injectionPackagist · cakephp/cakephp · fixed in 4.5.12, 4.6.5, 5.1.9 and more
- CVE-2026-77635CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverPackagist · cakephp/cakephp, cakephp/database · fixed in 5.3.7, 5.2.15, 5.1.10
- CVE-2026-77567Filament: App-based MFA can be bypassed when recovery codes are enabledPackagist · filament/filament · fixed in 4.12.0, 5.7.0
- CVE-2026-76098Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in MarkdownPyPI · mistune · fixed in 3.3.3
- CVE-2026-77310jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)Maven · com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind · fixed in 2.18.9, 2.21.5, 2.22.1 and more
- CVE-2026-76835OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy SetGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.15.2
- CVE-2026-78329Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routesMaven · org.apache.camel:camel-undertow · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-71300Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injectionMaven · org.apache.camel:camel-atmosphere-websocket · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-63621Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategyMaven · org.apache.camel:camel-knative · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-66908Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was acceptedMaven · org.apache.camel:camel-platform-http-main · fixed in 4.22.0
- CVE-2026-66907Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultMaven · org.apache.camel:camel-google-storage · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-66906Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirMaven · org.apache.camel:camel-azure-storage-blob · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-60093Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDirMaven · org.apache.camel:camel-azure-storage-datalake · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-59230Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabledMaven · org.apache.camel:camel-mail · fixed in 4.14.9, 4.18.4, 4.22.0
- CVE-2026-76845adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extractionnpm · adm-zip
- CVE-2026-76844zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Writenpm · webpack-dev-middleware · fixed in 8.3.0, 7.4.6
- RUSTSEC-2026-0437Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_certificates · fixed in 1.0.1, 1.1.0-beta.2
- RUSTSEC-2026-0438Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_secrets · fixed in 1.0.1
- RUSTSEC-2026-0439Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_keys · fixed in 1.0.1
- CVE-2026-76172fast-uri vulnerable to host confusion via percent-encoded scheme normalizationnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3
- CVE-2026-75975fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationnpm · fast-uri · fixed in 2.4.5, 3.1.6, 4.1.3