Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplatecrates.io · zebra-rpc, zebrad · fixed in 8.0.0, 4.5.0
- CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipcrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blockscrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parsercrates.io · zebra-script, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejectioncrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retentioncrates.io · zebrad · fixed in 4.5.0
- CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead blockcrates.io · zebra-consensus, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-71417Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking itPyPI · lemur · fixed in 1.9.3
- CVE-2026-71322Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalsePyPI · lemur · fixed in 1.9.3
- CVE-2026-71317Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityPyPI · lemur · fixed in 1.9.3
- CVE-2026-70666Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLsPyPI · lemur · fixed in 1.9.3
- CVE-2026-71303Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlistPyPI · lemur · fixed in 1.9.3
- CVE-2026-71307Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations APIPyPI · lemur · fixed in 1.9.3
- CVE-2026-71308Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificatesPyPI · lemur · fixed in 1.9.3
- CVE-2026-70667Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)PyPI · lemur · fixed in 1.9.3
- CVE-2026-55164Lemur: Plaintext password storage in Lemur user-update pathPyPI · lemur · fixed in 1.9.2
- CVE-2026-55162Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificatesPyPI · lemur · fixed in 1.9.2
- CVE-2026-55166Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDORPyPI · lemur · fixed in 1.9.2
- CVE-2026-55163Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membershipPyPI · lemur · fixed in 1.9.2
- CVE-2026-55165Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosurePyPI · lemur · fixed in 1.9.2
- CVE-2026-17106Tar extraction in moby/go-archive can write outside the destination directory via link followingGo · github.com/moby/go-archive · fixed in 0.3.0
- CVE-2026-65959Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL dataGo · vitess.io/vitess · fixed in 0.23.6, 0.24.3
- CVE-2026-69160OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIGo · github.com/openlistteam/openlist, github.com/openlistteam/openlist/v3 +1 · fixed in 4.2.4
- CVE-2026-48508Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermissionPyPI · lemur · fixed in 1.9.1
- CVE-2026-49452WeasyPrint: CSS Injection via Presentational HintsPyPI · weasyprint
- CVE-2026-73502kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schemaGo · github.com/getkin/kin-openapi · fixed in 0.144.0
- CVE-2026-53533aiosmtplib: SMTP command injection via CR/LF in sender/recipient addressPyPI · aiosmtplib · fixed in 5.1.1
- CVE-2026-50143Actor MCP path authority injection leaks Apify tokennpm · @apify/actors-mcp-server · fixed in 0.10.11
- CVE-2026-68923MobSF: CSRF checks not enforced after Django migrationPyPI · mobsf · fixed in 4.5.1
- CVE-2026-68927MobSF: SSRF port restriction bypass in assetlinks_checkPyPI · mobsf · fixed in 4.5.1