Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-52889Formie: Server-Side Template Injection in Formie Hidden field defaultsPackagist · verbb/formie · fixed in 3.1.27
- CVE-2026-52834jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformscrates.io · jxl-grid · fixed in 0.6.2
- CVE-2026-52792Algernon: Server-side script source disclosure on Windows via NTFS filenameGo · github.com/xyproto/algernon · fixed in 1.17.9
- CVE-2026-49289SimpleSAMLphp SAML2: Possible DoS via XPath TransformPackagist · simplesamlphp/saml2, simplesamlphp/saml2-legacy · fixed in 4.20.3, 4.19.3
- CVE-2026-49283SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypassPackagist · simplesamlphp/saml2, simplesamlphp/saml2-legacy · fixed in 6.2.1, 5.0.6, 4.20.2 and more
- CVE-2026-44829Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenameGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.33.0
- CVE-2026-45742Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')Go · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.33.0
- CVE-2026-45741Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8
- CVE-2026-49253electerm: Path Traversal in Zmodem and Trzsz Download Filename Handlingnpm · electerm · fixed in 3.11.11
- CVE-2026-49255electerm: Command Injection in File System Operations (rmrf, mv, cp)npm · electerm · fixed in 3.11.11
- CVE-2026-50149Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate EnabledGo · github.com/projectcontour/contour · fixed in 1.33.5
- CVE-2026-76245stigmem Federation Peer Token Timestamp Validation BypassPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76244stigmem-node Insecure Federation Transport ConfigurationPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76243stigmem before 0.9.0a2 Authentication Bypass via Disabled AuthPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76242stigmem Federation Peer Registration Authentication BypassPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76241stigmem Plugin Signature Enforcement Bypass via ConfigurationPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76240stigmem Postgres SQL Injection via Schema IdentifierPyPI · stigmem-node · fixed in 0.9.0a2
- CVE-2026-76239Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_addressPyPI · stigmem-node · fixed in 0.9.0a11
- CVE-2026-76238stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweepPyPI · stigmem-node · fixed in 0.9.0a12
- CVE-2026-76237stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantinePyPI · stigmem-node · fixed in 0.9.0a12
- CVE-2026-76236stigmem before 0.9.0a12 Cross-Tenant BOLA via TombstonesPyPI · stigmem-node · fixed in 0.9.0a12
- CVE-2026-76234libcrux before 0.0.6 Cryptographic Implementation Bug Fixescrates.io · libcrux-ecdh, libcrux-ed25519 +1 · fixed in 0.0.6, 0.0.7
- CVE-2026-76233Renovate 39.53.0 before 40.33.0 Command Injection via gleam managernpm · renovate · fixed in 40.33.0
- CVE-2026-76232Renovate 31.51.0 before 40.33.0 Command Injection via helmv3npm · renovate · fixed in 40.33.0
- CVE-2026-76231Renovate 32.135.0 before 40.33.0 Command Injection via hermitnpm · renovate · fixed in 40.33.0
- CVE-2026-76230Renovate 35.63.0 before 40.33.0 Command Injection via npmnpm · renovate · fixed in 40.33.0
- CVE-2026-76229Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomizenpm · renovate · fixed in 40.33.0
- CVE-2026-76228Renovate before 42.68.5 Remote Code Execution via Gradle Wrappernpm · renovate · fixed in 42.68.5
- CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposurenpm · renovate · fixed in 42.96.3, 43.4.4
- CVE-2026-76226Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenancenpm · renovate · fixed in 43.102.11